Soda PDF Desktop CVE-2025-14406

Exploitation requires the attacker to already possess the ability to execute low-privileged code on the target Windows host (local foothold) and to write to the unsecured location from which Soda PDF Desktop loads its OpenSSL configuration file (CWE-427 uncontrolled search path). The core prerequisite is that Soda PDF resolves and loads an OpenSSL config from a directory writable by a non-privileged user; the escalation then occurs when a SYSTEM-privileged component consumes that attacker-supplied config. Limiting factors: no remote vector (local only), the attacker must already have standard-user execution, and the affected product (Soda PDF Desktop build 14.0.509.23030) must be installed and its vulnerable OpenSSL-loading component invoked.

This is a credible local privilege-escalation issue that merits patching but is not an emergency. The provided CVSS:3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: exploitation is local (AV:L), requires the attacker to already run low-privileged code on the host (PR:L), needs no user interaction, and yields full confidentiality/integrity/availability impact by executing as SYSTEM. No EPSS score, CISA KEV entry, or public POC was supplied with this data, and the only reference is the ZDI advisory (ZDI-25-1079), so there is no signal of active exploitation or mass scanning - consistent with the fact that local privesc bugs are rarely automatable at scale. No SSVC decision data was provided. Net: a real but post-foothold risk (an attacker must already be on the box), appropriate to prioritize for workstation hardening and patch rollout rather than as a remotely-exploitable critical. Note a minor nuance: achieving SYSTEM from a low-privileged user is effectively a scope-crossing outcome, yet the vector lists S:U; this does not change the practical severity but is worth noting when comparing to other privesc entries.

A low-privileged user (or malware already running under a standard account) plants a malicious OpenSSL configuration file in the unsecured, attacker-writable location that Soda PDF Desktop searches. When the product's SYSTEM-level component loads that config, attacker-controlled code (e.g., a malicious OpenSSL engine/module directive) executes with SYSTEM privileges. No public exploit was identified in the provided data, but the technique is well understood and the ZDI advisory confirms the flaw.