CVE-2025-13845 HIGH

CVE-2025-13845

Vendor Schneider Electric
Product EcoStruxure Power Build Rapsody
Weakness CWE-416
Published January 15, 2026
Last update January 15, 2026
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.

Key dates

02Disclosure timeline

January 15, 2026 CVE published
January 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-54588 Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults CVE-2023-4733 Use After Free in vim/vim CVE-2023-27329 Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability CVE-2025-59189 Microsoft Brokering File System Elevation of Privilege Vulnerability CVE-2023-38222 ZDI-CAN-21103: Adobe Acrobat Reader DC AcroForm spawnPageFromTemplate Use-After-Free Remote Code Execution Vulnerability