Soda PDF Desktop CVE-2025-14408

Exploitation requires the victim to open attacker-controlled content in Soda PDF Desktop - either by opening a malicious PDF file directly or by visiting a malicious page that serves one (UI:R). The flaw is reached specifically through Soda PDF's PDF file-parsing routine, which fails to validate user-supplied data before reading past the end of an allocated object. Limiting factors that reduce real-world risk: mandatory user interaction, no network-service exposure (AV:L - the malicious file must be processed locally by the application), no privileges needed by the victim's side, and only limited information disclosure on its own. Meaningful impact (code execution) additionally requires a separate, chainable vulnerability, which this CVE does not provide.

This is a genuinely low-priority issue by every available signal, and they are mutually consistent rather than conflicting. The CVSS 3.0 base score is 3.3 (Low) driven by a local attack vector (AV:L), low complexity (AC:L), no privileges (PR:N), but required user interaction (UI:R), unchanged scope, and only low confidentiality impact with no integrity or availability impact (C:L/I:N/A:N) - i.e. an out-of-bounds read that leaks a limited amount of memory, not code execution on its own. EPSS reinforces this: 0.17% probability at the 6th percentile indicates very low near-term exploitation likelihood. There is no CISA KEV listing (not actively exploited) and no public exploit identified - the only reference is the ZDI advisory itself, which does not publish working exploit code. Note the apparent tension worth flagging: the description says 'remote attackers' while the CVSS vector specifies AV:L - this is standard ZDI modeling for file/page-parsing bugs where the victim must open attacker-supplied content locally, so it is not a true contradiction, but defenders should treat it as local/user-interaction-gated rather than network-remote. The 'RCE' tag reflects the advisory's note that the bug can be chained with other vulnerabilities for code execution, NOT that this CVE alone yields RCE; do not over-escalate on the tag alone.

An attacker crafts a malicious PDF and either hosts it on a web page or delivers it via email/download, then lures a Soda PDF Desktop user into opening it. When Soda PDF parses the malformed file, the flawed validation triggers an out-of-bounds read that discloses adjacent process memory, which an attacker could combine with a separate vulnerability to achieve code execution. No public exploit code is identified at time of analysis; exploitation requires the user to actively open the malicious file.