CVE-2025-14412: high-severity vulnerability in Soda PDF Desktop
Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.2%
Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27495.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Soda PDF · DesktopRelated CVEs — Soda PDF Desktop
In the same product, most dangerous first.
CVE-2025-14413HIGHSoda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-14415HIGHSoda PDF Desktop Launch Insufficient UI Warning Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14414HIGHSoda PDF Desktop Word File Insufficient UI Warning Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-14409HIGHSoda PDF Desktop PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-14407LOWSoda PDF Desktop PDF File Parsing Memory Corruption Information Disclosure VulnerabilityEPSS 0.2%CVE-2025-14411LOWSoda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 0.2%