Soda PDF Desktop CVE-2025-14407

Exploitation requires the victim to open an attacker-crafted PDF file in Soda PDF Desktop (version 14.0.509.23030 per the ZDI advisory) or visit a malicious page that delivers one - the flaw is in the application's PDF file parsing logic, triggered by malformed/unvalidated user-supplied data in the PDF. Limiting factors: the attack is local and client-side (AV:L) and mandates active user interaction (UI:R), so it cannot be triggered remotely without luring a user to open the file; direct impact is confined to disclosure of sensitive in-process memory (C:H, I:N, A:N), and achieving code execution additionally depends on chaining with a separate vulnerability.

This is a moderate, low-priority issue rather than an urgent one. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) reflects a local attack vector requiring user interaction, with impact limited to confidentiality (C:H) and no integrity or availability effect - consistent with the described information-disclosure outcome. All exploitation signals point the same direction: EPSS is very low at 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no evidence of active or widespread exploitation. The one point of tension is between the 'RCE' tag and the actual metrics: the description states an attacker can only achieve code execution 'in conjunction with other vulnerabilities,' and the CVSS vector scores I:N/A:N, so this CVE on its own is an info-leak primitive, not a standalone RCE - the RCE tag describes potential chained impact, not this bug's direct effect. No key signals are missing beyond the absence of an EPSS-raising exploit; the data is internally consistent. Net: a real but low-urgency client-side vulnerability best handled through normal patch cycles.

An attacker crafts a malicious PDF and lures a Soda PDF Desktop user into opening it (via email attachment, download, or a malicious web page). When the application parses the file, improperly validated data triggers a memory corruption condition that leaks sensitive process memory back to attacker-controlled content. Exploitation requires active user interaction and local file handling (AV:L/UI:R), and no public proof-of-concept was identified at time of analysis.