CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.
Weakness
The product calls free() twice on the same memory address.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ecostruxure_power_build_-_rapsody | Schneider-electric | * | 2.8.1 (including) |
| Ecostruxure_power_build_-_rapsody | Schneider-electric | * | 2.8.3 (including) |
| Ecostruxure_power_build_-_rapsody | Schneider-electric | * | 2.8.5 (including) |
| Ecostruxure_power_build_-_rapsody | Schneider-electric | * | 2.8.6 (including) |
| Ecostruxure_power_build_-_rapsody | Schneider-electric | * | 2.8.8 (including) |
Potential Mitigations
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-013-04.pdf