How severe is CVE-2025-13844?

CVE-2025-13844 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2025-13844 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-13844?

CVE-2025-13844 primarily affects Schneider-electric Ecostruxure Power Build - Rapsody. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-13844?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-13844 have an EU (EUVD) identifier?

Yes. CVE-2025-13844 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2720.

When was CVE-2025-13844 published?

CVE-2025-13844 was published on 2026-01-15 and last updated on 2026-06-17.

CVE-2025-13844

CVE-2025-13844 is a medium-severity vulnerability in Schneider-electric Ecostruxure Power Build - Rapsody with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-415.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 8.4
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-2720
Weakness: CWE-415
Affected product: Schneider-electric Ecostruxure Power Build - Rapsody
Published: 2026-01-15
Last modified: 2026-06-17

Description

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

Frequently asked questions

What is CVE-2025-13844?: CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.
How severe is CVE-2025-13844?: CVE-2025-13844 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2025-13844 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-13844?: CVE-2025-13844 primarily affects Schneider-electric Ecostruxure Power Build - Rapsody. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-13844?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-13844 have an EU (EUVD) identifier?: Yes. CVE-2025-13844 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2720.
When was CVE-2025-13844 published?: CVE-2025-13844 was published on 2026-01-15 and last updated on 2026-06-17.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf

Affected products (5)

cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:fr:*:*:*
cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:bel_nl:*:*:*
cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:es:*:*:*
cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:int:*:*:*
cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:bel_fr:*:*:*

More vulnerabilities in Schneider-electric Ecostruxure Power Build - Rapsody

CVE-2025-13845 — High (CVSS 7.8): CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious…
CVE-2021-22698 — High (CVSS 7.8): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build -…
CVE-2021-22697 — High (CVSS 7.8): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build -…

All CVEs affecting Schneider-electric Ecostruxure Power Build - Rapsody →

Other CWE-415 (Double Free) vulnerabilities

CVE-2018-0101 — Critical (CVSS 10.0): A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…
CVE-2026-8925 — Critical (CVSS 9.8): The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing…
CVE-2020-37239 — Critical (CVSS 9.8): libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety…
CVE-2026-43011 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When…
CVE-2026-31609 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in…
CVE-2026-31608 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in…

Browse all CWE-415 (Double Free) vulnerabilities →