PDFsam Enhanced CVE-2025-14405

Exploitation requires physical presence at the target and the specific ability to mount a malicious drive onto the system so that PDFsam Enhanced loads its OpenSSL configuration file from that attacker-controlled, unsecured location (the uncontrolled search path element, CWE-427). The product must be PDFsam Enhanced (CPE indicates version 7.0.76.15222) running on Windows, since the impact is code execution as SYSTEM. Limiting factors that reduce real-world risk: no network exploitation is possible (AV:P), the attacker must physically attach/mount removable or external storage, and exploitation depends on the product actually being installed and invoking OpenSSL config loading from the insecure path.

This is a moderate, context-dependent risk rather than an urgent priority. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8) is dominated by the Physical attack vector (AV:P), which is the single largest factor capping severity despite full High confidentiality, integrity, and availability impact and a SYSTEM-level outcome. The description reinforces this: the attacker must be physically present and must first obtain the ability to mount a malicious drive onto the target, so this is not remotely exploitable. The EPSS score is low (0.33%, 25th percentile), which is consistent with a physically-gated local privilege escalation that cannot be mass-exploited over a network. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation or weaponization. SSVC-style reasoning: exploitation status is none observed, the flaw is NOT automatable (physical access and drive-mounting are required), and technical impact is total (SYSTEM code execution). Net assessment: a genuine SYSTEM-level privilege escalation worth patching on endpoints where untrusted physical access or removable media is plausible (kiosks, shared workstations, lab machines), but low priority for environments with controlled physical access. No conflicting signals were found - the CVSS vector, EPSS, and description all agree that this is a local/physical issue.

An attacker with physical access to a Windows machine running PDFsam Enhanced mounts a malicious drive (for example a crafted USB or network/virtual volume) placed at the unsecured location from which the product loads its OpenSSL configuration file. When PDFsam Enhanced reads the attacker-controlled OpenSSL config, it loads attacker-specified content that results in arbitrary code execution in the context of SYSTEM, escalating the attacker from physical/local access to full privileges. No public proof-of-concept exploit has been identified at the time of analysis.