PDFsam Enhanced CVE-2025-14404

Exploitation requires the victim to open a maliciously crafted XLS file in PDFsam Enhanced (version 7.0.76.15222 per the CPE), or visit a page that delivers such a file; the flaw is that the application executes dangerous script embedded in the XLS without presenting a user warning (CWE-356). Limiting factors: the attack is local/client-side (AV:L) and cannot be triggered against a network service, it is gated by mandatory user interaction (UI:R) - the user must actively open the file - and it carries high attack complexity (AC:H), meaning the file must meet specific conditions to execute reliably. No authentication is required of the attacker (PR:N), and code runs only in the context of the current user (no scope change / no privilege escalation).

Signals are moderate and largely consistent. The CVSS 3.0 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a client-side code-execution flaw: no privileges needed (PR:N) but mandatory user interaction (UI:R) and high attack complexity (AC:H), with full confidentiality/integrity/availability impact in the current user's context (no scope change). Despite the phrase 'remote attackers' in the ZDI-authored description, the authoritative vector is AV:L - the attack is delivered via a file the victim opens or a page they visit, not a direct network-facing service; this is the standard ZDI classification for file-handling RCE and the two are not in conflict once understood. CWE-356 (insufficient UI warning before an unsafe action) matches the stated root cause: dangerous script in an XLS file executes without warning the user. No EPSS score, CISA KEV listing, or public POC was supplied in the input. This is therefore a genuine but non-urgent priority: high technical impact and no authentication, offset by required user interaction, high complexity, local vector, and no evidence of exploitation or exploit availability. Realistically it ranks below network-facing unauthenticated RCEs; patch on a normal cycle rather than emergency.

An attacker crafts a malicious XLS file embedding dangerous script and delivers it via phishing email or a lure web page. When a PDFsam Enhanced user opens the file, the application processes it and executes the embedded script without any warning prompt, running arbitrary code with that user's privileges. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) implies the crafted file must satisfy specific conditions to trigger reliably.