CVE-2025-13844
📋 TL;DR
A double free vulnerability in Rapsody software allows attackers to cause heap memory corruption by tricking users into importing malicious SSD project files. This affects all Rapsody users who import untrusted project files. The vulnerability could lead to application crashes or potentially arbitrary code execution.
💻 Affected Systems
- Rapsody
📦 What is this software?
Ecostruxure Power Build Rapsody by Schneider Electric
Ecostruxure Power Build Rapsody by Schneider Electric
Ecostruxure Power Build Rapsody by Schneider Electric
Ecostruxure Power Build Rapsody by Schneider Electric
Ecostruxure Power Build Rapsody by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Rapsody application user, potentially leading to full system compromise.
Likely Case
Application crash or denial of service when processing malicious SSD files, with potential for limited code execution.
If Mitigated
Application instability or crashes without code execution if memory corruption doesn't lead to exploitable conditions.
🎯 Exploit Status
Exploitation requires user interaction to import malicious file. Double free vulnerabilities can be challenging to weaponize reliably but are serious memory corruption issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in reference; check Schneider Electric advisory for specific patched versions
Vendor Advisory: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf
Restart Required: Yes
Instructions:
1. Download the latest Rapsody version from Schneider Electric. 2. Install the update following vendor instructions. 3. Restart the application and any related services. 4. Verify the patch is applied by checking version.
🔧 Temporary Workarounds
Restrict SSD file imports
allConfigure Rapsody to block or warn on SSD file imports from untrusted sources
User training and policies
allImplement policies prohibiting import of untrusted project files and train users on risks
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of malicious code if exploitation occurs
- Use network segmentation to isolate Rapsody systems from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check if Rapsody version is before the patched version specified in Schneider Electric advisory SEVD-2026-013-04Check Version:
Check within Rapsody application: Help → About or version command in installation directoryVerify Fix Applied:
Verify Rapsody version matches or exceeds the patched version from the vendor advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes when importing SSD files
- Memory access violation errors in application logs
- Unexpected process termination
Network Indicators:
- Downloads of SSD files from untrusted sources
- Unusual outbound connections after file import
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="Rapsody.exe" AND (Message LIKE "%access violation%" OR Message LIKE "%heap corruption%")