Soda PDF Desktop CVE-2025-14409

Exploitation requires a user of Soda PDF Desktop (affected build 14.0.509.23030) to open an attacker-supplied malicious PDF, or visit a malicious page that serves/opens one - this user-interaction requirement (UI:R) is the primary limiting factor. The flaw is in the PDF parsing routine and triggers from the lack of validation of user-supplied data causing a write past an allocated buffer, so merely receiving a file is not enough; the file must actually be parsed by the application. No authentication or elevated privileges are needed (PR:N), and no non-default configuration is required - default installations parsing a crafted PDF are vulnerable. The attack is local-vector (AV:L): the malicious file must be delivered to and opened on the target host rather than exploited across a network service.

This is a memory-corruption RCE (CWE-787 out-of-bounds write) in Soda PDF Desktop's PDF file parser, scored CVSS 7.8 (HIGH) by ZDI/NVD with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals are mostly consistent but warrant caution. The CVSS vector is LOCAL (AV:L) with required user interaction (UI:R), which is the standard ZDI modeling for client-side file-parsing bugs: the attacker does not reach the machine over the network directly, but instead must deliver a malicious PDF that a user opens - so the description's phrase 'remote attackers' refers to remote delivery, NOT a network-exploitable (AV:N) service. This is a meaningful distinction for prioritization: exploitation is not wormable or unauthenticated-remote in the server sense, and depends entirely on social engineering. No EPSS score is provided in the input, so exploitation probability cannot be quantified. KEV status is not indicated (not listed), and no public proof-of-concept is referenced, so this is not confirmed as actively exploited. No SSVC decision data was supplied. Net assessment: a genuine high-impact client-side RCE (full C/I/A compromise in the process context) that is credible and vendor-validated by Trend Micro ZDI, but absent evidence of exploitation or a public exploit it ranks as an important patch-soon item rather than an emergency drop-everything issue - real priority is moderate, gated by the user-interaction requirement and the client-side (not server-side) attack surface.

An attacker crafts a malicious PDF that triggers an out-of-bounds write during parsing and emails it to a victim or hosts it on a web page. When the victim opens the file (or visits the page) in Soda PDF Desktop, the malformed data corrupts memory beyond an allocated buffer, letting the attacker execute arbitrary code in the context of the current user. No public exploit code is identified at time of analysis, and because the CVSS vector is AV:L/AC:L/UI:R, exploitation is low-complexity but requires the target to open the attacker's file.