PDFsam Enhanced CVE-2025-14403

Exploitation requires the victim to actively open an attacker-crafted file or visit a malicious page in PDFsam Enhanced that triggers the Launch action; the core defect is that this action executes dangerous script without presenting any user warning (CWE-356). Limiting factors: UI:R means no exploitation occurs without user interaction (opening the file / visiting the page), the affected build is specifically PDFsam Enhanced 7.0.76.15222, and execution is confined to the privileges of the current user (S:U, no privilege escalation). It is unauthenticated (PR:N) in the sense that the attacker needs no credentials on the target, but success depends entirely on social-engineering the user into opening hostile content.

This is a client-side remote code execution flaw (CWE-356, Insufficient UI Warning) in PDFsam Enhanced, disclosed via Trend Micro ZDI (ZDI-25-1091, formerly ZDI-CAN-27500). The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) shows AV:L (local), PR:N (unauthenticated), and UI:R (user interaction required), with full C/I/A impact - the classic ZDI client-side pattern where 'local' means the malicious content executes on the victim's own machine after they open a file or visit a page, not that the attacker needs prior local access. Note the apparent tension: the CVSS vector is AV:L yet the title and description call this 'Remote Code Execution' and reference 'remote attackers' - this is a deliverable-over-the-network-but-executed-locally flaw, so AV:L is technically correct while the practical delivery is remote. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or at-scale exploitation. The dependence on user interaction (opening a crafted file / visiting a malicious page) and the low enterprise footprint of this desktop product mean real-world risk is moderate: a high-severity bug per CVSS, but exploitation requires social engineering and the affected product is not broadly deployed, making opportunistic mass exploitation unlikely.

An attacker crafts a malicious PDF or web page that abuses PDFsam Enhanced's Launch action to run a dangerous script without surfacing any warning to the user. The victim opens the file (or visits the page) in PDFsam Enhanced, and code executes in the context of the current user. No public exploit code was identified at time of analysis, though the flaw was found and detailed by Trend Micro ZDI.