PDFsam Enhanced CVE-2025-14401

Exploitation requires the victim to open an attacker-crafted file (or visit a page that delivers one) in PDFsam Enhanced; the malicious content must contain a malformed App object that is parsed by the application's App-object handling code. The decisive limiting factor is mandatory user interaction (UI:R) - there is no remote, unauthenticated, zero-click path. Exploitation is further constrained to systems that have PDFsam Enhanced (the commercial edition, confirmed affected at 7.0.76.15222) installed and used to open the file; the free PDFsam Basic is not referenced as affected. No special authentication or privilege is required (PR:N), but code executes only in the context of the user who opens the file.

This is a client-side, file-parsing remote code execution flaw (CWE-125 out-of-bounds read) in PDFsam Enhanced, assessed by ZDI/Trend Micro at CVSS 7.8. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent with the description: despite the 'remote attackers' phrasing, the attack vector is Local (AV:L) because exploitation requires the victim to open a malicious file or visit a malicious page - i.e., the attacker-controlled data must be processed on the target's own machine. The PR:N/UI:R combination confirms no authentication is needed but mandatory user interaction is the gating factor. No EPSS score, CISA KEV entry, or SSVC decision data was provided in the input, and no public exploit is referenced - the only source is the ZDI advisory ZDI-25-1089 describing the broker-disclosed finding. Signals therefore align rather than conflict: high local/complete-impact CVSS but no evidence of active exploitation or weaponization. The practical risk is bounded by the requirement for user interaction and the relatively limited deployment of the paid 'Enhanced' edition, making this a moderate, interaction-dependent priority rather than an urgent mass-exploitation threat. Note the CWE (CWE-125, out-of-bounds READ) and the 'Buffer Overflow' tag are not perfectly aligned - the primitive is an over-read leveraged to RCE, not a classic write overflow.

An attacker crafts a malicious PDF (or a web page delivering one) with a malformed App object and socially engineers a user into opening it in PDFsam Enhanced. When the application parses the App object without validating the user-supplied data, it reads past the end of an allocated buffer, which the attacker leverages to execute arbitrary code in the context of the current user process. No public exploit code is identified at time of analysis; the finding originates from ZDI advisory ZDI-25-1089.