EN PT-BR
← Voltar ao feed
medium

Schneider Electric EcoStruxure Power Build Rapsody: use-after-free (CVE-2026-119055) enables arbitrary code execution

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 21:00 · coletado há 2 horas

Schneider Electric published security notice SEVD-2026-314-01 on 10 November 2026 for CVE-2026-119055, a use-after-free in EcoStruxure Power Build Rapsody, the software used to enter or import single-line diagrams and produce switchboard bills of material (download.se.com). The vendor rates the flaw Medium and gives no CVSS score in its excerpt (download.se.com). The article, relaying a CERT-FR advisory, states that it allows arbitrary code execution and lists eight language builds, each affected below a fixed threshold version. The sources read for this research give no attack prerequisites for this CVE, and the vendor excerpt reports no exploitation. A third-party aggregator lists the flaw as High and not known to be exploited, with a different affected range (radar.offseq.com); the vendor rating prevails. Urgency is medium: the vendor rates it Medium, no exploitation is reported, and the prerequisites are not confirmed in the sources read.

Entenda a falha

A vulnerabilidade

CVE-2026-119055 is a use-after-free in Schneider Electric EcoStruxure Power Build Rapsody, the software used to enter or import single-line diagrams and produce switchboard bills of material. CERT-FR says it lets an attacker execute arbitrary code. The sources give no attack prerequisites (network reach, authentication, user interaction). Schneider rates it Medium with no CVSS score in the excerpt, while an aggregator says High. Eight language builds are affected below these versions: BEL(EN) V2.9.3.0000, BEL(FR) V2.9.8.0000, ESP V2.9.5.0000, FR V2.9.12.0101, INT(EN) V2.9.4.0000, INT(FR) V2.9.6.0000, NL V2.9.6.0000 and PT V2.9.7.0000.

Como funciona

The articles do not describe the vulnerable code path. All that is known is that the vendor classifies the flaw as a use-after-free in the Rapsody application, which handles single-line diagrams and bill-of-material generation. In general terms, the software uses a memory object after it has been released, and that can lead to arbitrary code execution. The input or event that triggers it is not stated in the sources.

Por que é vulnerável

The root cause is a use-after-free, meaning memory is referenced after being freed. The sources do not say which component or logic error causes it, why it went unnoticed, or what the fix changes in the code. The remedy is to upgrade to the fixed builds listed in SEVD-2026-314-01.

Como foi descoberta

The articles do not say who found the flaw or how. Schneider Electric disclosed it in security notice SEVD-2026-314-01 on 10 November 2026, and CERT-FR relayed it the same day in advisory CERTFR-2026-AVI-1494. The vendor excerpt reports no exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:47.

Detalhes técnicos

  • The vendor classifies CVE-2026-119055 as a use-after-free and titles its notice accordingly (download.se.com).
  • The article's version list covers BEL(EN) before V2.9.3.0000, BEL(FR) before V2.9.8.0000, ESP before V2.9.5.0000, FR before V2.9.12.0101, INT(EN) before V2.9.4.0000, INT(FR) before V2.9.6.0000, NL before V2.9.6.0000 and PT before V2.9.7.0000.
  • The vendor's CVSS v4.0 vector and the attack prerequisites are not shown in the excerpt read (download.se.com).

Remediação

  • Upgrade to the fixed builds named in SEVD-2026-314-01 (download.se.com). The excerpt read does not list fixed version numbers, so the article's thresholds are the only version boundaries available: a build at or above each listed threshold is outside the affected range.
  • The vendor notice states that its fix commitment does not extend to products or versions outside support or warranty (download.se.com). Unsupported installations need a migration plan.

Relatos divergentes

  • The aggregator radar.offseq.com labels the flaw High and gives an affected range of versions up to 2.9.1.0 and 2.9.12.0101 (radar.offseq.com). The vendor's Medium rating and the per-build list in the article prevail.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04 primeiro registro

    Schneider Electric EcoStruxure Power Build Rapsody: use-after-free (CVE-2026-119055) enables arbitrary code execution

    ler a análise desta fonte

    Schneider Electric published security notice SEVD-2026-314-01 on 10 November 2026 for CVE-2026-119055, a use-after-free in EcoStruxure Power Build Rapsody, the software used to enter or import single-line diagrams and produce switchboard bills of material (download.se.com). The vendor rates the flaw Medium and gives no CVSS score in its excerpt (download.se.com). The article, relaying a CERT-FR advisory, states that it allows arbitrary code execution and lists eight language builds, each affected below a fixed threshold version. The sources read for this research give no attack prerequisites for this CVE, and the vendor excerpt reports no exploitation. A third-party aggregator lists the flaw as High and not known to be exploited, with a different affected range (radar.offseq.com); the vendor rating prevails. Urgency is medium: the vendor rates it Medium, no exploitation is reported, and the prerequisites are not confirmed in the sources read.

    Technical Details

    • The vendor classifies CVE-2026-119055 as a use-after-free and titles its notice accordingly (download.se.com).
    • The article's version list covers BEL(EN) before V2.9.3.0000, BEL(FR) before V2.9.8.0000, ESP before V2.9.5.0000, FR before V2.9.12.0101, INT(EN) before V2.9.4.0000, INT(FR) before V2.9.6.0000, NL before V2.9.6.0000 and PT before V2.9.7.0000.
    • The vendor's CVSS v4.0 vector and the attack prerequisites are not shown in the excerpt read (download.se.com).

    Remediation

    • Upgrade to the fixed builds named in SEVD-2026-314-01 (download.se.com). The excerpt read does not list fixed version numbers, so the article's thresholds are the only version boundaries available: a build at or above each listed threshold is outside the affected range.
    • The vendor notice states that its fix commitment does not extend to products or versions outside support or warranty (download.se.com). Unsupported installations need a migration plan.

    Conflicting Reports

    • The aggregator radar.offseq.com labels the flaw High and gives an affected range of versions up to 2.9.1.0 and 2.9.12.0101 (radar.offseq.com). The vendor's Medium rating and the per-build list in the article prevail.