PT-2026-3086 · Rhapsody · Rhapsody

Published 2026-01-13 · Updated 2026-03-03 · CVE-2025-13844

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Rapsody (affected versions not specified)

Description A double free issue exists that can lead to heap memory corruption. This occurs when a user imports a malicious project file (SSD file) provided by an attacker. The issue involves freeing the same memory location twice, potentially allowing an attacker to control program execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2026-04460

CVE-2025-13844

Affected Products

Rhapsody

References · 6

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13844 · Security Note
• https://bdu.fstec.ru/vul/2026-04460 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13844 · Vendor Advisory
• https://twitter.com/CVEnew/status/2011926072687022179 · Twitter Post
• https://t.me/cveNotify/153982 · Telegram Post