CVE-2025-13844

MediumCVSS 5.3/10Last modified Sep 3, 2026

Description

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Jan 15, 2026
Last modified
Sep 3, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-138457.8CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file)CVE-2025-138466.4The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and CVE-2025-138476.4The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and includinCVE-2025-138486.4The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to,CVE-2025-138496.4The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and CVE-2025-13857.5When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server toCVE-2025-138506.4The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up tCVE-2025-138519.8The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all veCVE-2025-138526.4The Debt.com Business in a Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configuration' parameter of the leCVE-2025-138536.4The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcCVE-2025-138546.4The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in allCVE-2025-138558.8IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially craf
CVE-2025-13844: Medium severity, CVSS 5.3 | Vulnix