Out-of-bounds read in Soda PDF Desktop 14.0.509.23030 enables remote attackers to disclose limited contents of process memory when a victim opens a crafted PDF file or visits a malicious page serving one. Exploitation requires user interaction and local processing by the application; on its own the flaw provides only limited information disclosure, and code execution would require chaining a separate vulnerability. No public exploit was identified at time of analysis, and EPSS is low at 0.17% (6th percentile), consistent with a low-priority risk.
RCE
Buffer Overflow
Information Disclosure
Soda Pdf
NVD
CVSS 3.0
3.3
EPSS
0.2%