IBM Engineering Systems Design Rhapsody vulnerabilities

4 CVEs affecting IBM Engineering Systems Design Rhapsody, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-33077, published 2025-07-23.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-41779, published 2024-11-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted…
• CVE-2025-33076, published 2025-07-23. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute…
• CVE-2025-33077, published 2025-07-23. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute…
• CVE-2025-33020, published 2025-07-23. High severity, CVSS 7.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information.