Vulnerability · Published Jan 15, 2026 · Assigned by schneider
CVE-2025-13845
High 8.4
In plain English
A high-severity use-after-free in EcoStruxure Power Build Rapsody from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 4.0)8.4High
Exploit odds (30 days)0.4%top 71.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure Power Build Rapsody | FR v2.8.1.0300 and priorESP v2.8.5.0200 and priorPT v2.8.7.0100 and priorBEL (FR) v2.8.8.0100 and priorBEL (EN) v2.8.3.0100 and priorINT (EN) v2.8.4.0300 and priorNL v2.8.2.0000 and prior |
Weakness: CWE-416 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N