PDFsam Enhanced CVE-2025-14402

Exploitation requires the victim to open a maliciously crafted DOC file within PDFsam Enhanced (version 7.0.76.15222 confirmed affected), or visit a page that delivers such a file. The root condition is that PDFsam Enhanced's DOC-processing feature executes embedded dangerous script without displaying a user warning (CWE-356). Limiting factors: it is not remotely triggerable without victim action (UI:R), the attack is local (AV:L) - the attacker cannot reach the target over the network alone - and success depends on the user being induced to open attacker-supplied content; the vendor also rates attack complexity as High, implying the ideal attack may not always succeed.

Signals are sparse and point to a moderate, user-interaction-gated threat rather than an urgent priority. The vendor (Trend Micro ZDI) CVSS:3.0 vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.0), meaning a local attack delivered via a malicious file/page that the victim must open, with full compromise in the user's context. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or opportunistic exploitation - consistent with a ZDI coordinated disclosure rather than an in-the-wild finding. The one point of internal tension is the vendor's AC:H: the described defect (DOC processing executes dangerous script with no user warning, CWE-356) reads as deterministic once a crafted file is opened, which argues for lower complexity; I rate it AC:L below, so ZDI's AC:H may be conservative or reflect undisclosed preconditions - verify with the advisory. Net: real but not emergency - patch on a normal cadence, prioritize by how many users actually run PDFsam Enhanced.

An attacker crafts a malicious DOC file (or a web page that serves one) and uses social engineering to get a PDFsam Enhanced user to open it. Because the DOC-processing path executes embedded/dangerous script without presenting a safety warning, code runs automatically in the context of the current user. No public proof-of-concept was identified at the time of analysis.