Soda PDF Desktop
CVE-2025-14410
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious PDF to victim
-
DeliveryUser opens file in Soda PDF
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent process memory
-
ImpactChain with secondary bug for code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted PDF file (or visit a page serving one) in Soda PDF Desktop - the flaw is in the application's PDF file-parsing code and triggers only on processing attacker-controlled file data. Limiting factors: the attack vector is LOCAL (AV:L) and mandates user interaction (UI:R), so there is no server-side or unauthenticated-network exploitation; the standalone outcome is memory disclosure (C:H only), and achieving code execution additionally depends on chaining a separate vulnerability. Confirmed affected build is 14.0.509.23030; exposure is limited to endpoints where this desktop product is installed and used to open untrusted PDFs. |
| Impact | This is a genuine but comparatively low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5 Medium) establishes that exploitation is LOCAL and requires user interaction - the victim must open a malicious PDF or visit a malicious page - so this is not a remotely-triggerable, wormable flaw despite the 'remote attackers' language in the description. Impact is limited to confidentiality (C:H, I:N, A:N): an out-of-bounds read (CWE-125) that discloses memory contents, not code execution on its own. The EPSS score of 0.18% (7th percentile) is low and consistent with the lack of a public exploit and the user-interaction requirement, indicating no evidence of near-term widespread exploitation. There is no CISA KEV listing and no public POC identified. The description notes the OOB read can be chained 'in conjunction with other vulnerabilities to execute arbitrary code,' which is why the input Tags include 'RCE' and 'Buffer Overflow' - but on its own this CVE is an information-disclosure primitive, not RCE, so those tags overstate the standalone impact. Signals are mutually consistent (low EPSS, no KEV, no POC, local vector, UI required), so there is no conflict to flag; the main caveat is that affected-version data is thin. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF and lures a Soda PDF Desktop user into opening it (e.g., via email attachment or a drive-by download link). When the application parses the malformed file, it reads past the end of an allocated buffer and leaks adjacent process memory, which the attacker can use to defeat mitigations such as ASLR and chain with a separate memory-corruption bug for code execution. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
An out-of-bounds read in the PDF parsing engine of Soda PDF Desktop 14.0.509.23030 lets remote attackers disclose sensitive process memory by getting a victim to open a crafted PDF file or visit a page that serves one. The flaw is a missing validation of user-supplied data during file parsing, so the parser reads past the end of an allocated buffer; the standalone impact is confidentiality-only, and code execution would require chaining this memory disclosure with a separate vulnerability. Exploitation is local to the endpoint and requires user interaction, EPSS is low at 0.18% (7th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but comparatively low-priority issue.
RemediationAI
No vendor-released patch was identified in the available data, and the only reference is the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1083/, so check with Soda PDF for an updated 14.x build that addresses ZDI-CAN-27142 and upgrade to it as soon as one is published. Until then, treat all PDFs of untrusted origin as hostile on hosts running Soda PDF Desktop 14.0.509.23030: open them inside an isolated environment such as Windows Sandbox or a disposable VM (trade-off: no access to the host's files or saved profiles), or use a hardened alternative viewer for unknown documents (trade-off: loss of Soda PDF-specific features and workflow disruption for users). Lower-privilege execution helps limit the blast radius of a successful chain but does not stop memory disclosure (trade-off: requires re-provisioning user accounts and may break document plugins). Blocking or stripping PDF attachments at the mail and web gateway reduces delivery of crafted files, though it will not stop documents arriving through cloud drives or USB media. Note that disabling JavaScript in the viewer is not a reliable mitigation here, because the defect is in core file parsing rather than in script execution.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-125 out-of-bounds read inside Soda PDF Desktop's PDF file parser. PDF is a complex container format of nested objects, streams, cross-reference tables and length-prefixed structures; the parser is expected to validate offsets, counts and declared stream lengths against the actual size of the buffer it allocated before dereferencing them. Here that validation of attacker-supplied data is absent, so a maliciously constructed document can drive a read past the end of an allocated object, returning adjacent heap contents to code paths that surface them to the attacker (for example through rendered output or error behavior). Because the primitive is a read rather than a write, the direct consequence is information disclosure - potentially leaking pointers or heap layout that defeat ASLR and make a follow-on memory-corruption bug in the same application reliably exploitable. CPE data pins the confirmed affected build to cpe:2.3:a:sodapdf:soda_pdf:14.0.509.23030. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-27142 and published as ZDI-25-1083. Per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), the attack is local, unauthenticated and requires the user to open a malicious file or browse to a page that delivers it; exposure is limited to endpoints with this desktop product installed and used to open untrusted PDFs.
Know when Soda Pdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitation requires a user to open a malicious local file (AV:L, UI:R), needs no privileges (PR:N), and yields memory disclosure only (C:H, I:N, A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-27142.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
Soda PDF Desktop 14.0.509.23030 executes content reached through a PDF Launch action without surfacing the security warn
Remote code execution in Soda PDF Desktop 14.0.509.23030 is triggered when a user opens a crafted XLS file that causes e
Out-of-bounds write in Soda PDF Desktop's PDF parser can let attackers execute arbitrary code in the context of the curr
Local privilege escalation in Soda PDF Desktop 14.0.509.23030 allows an attacker who can already execute low-privileged
Multiple untrusted search path vulnerabilities in Soda PDF 5.1.183.10520 allow local users to gain privileges via a Troj
Memory corruption in Soda PDF Desktop's PDF parsing logic can disclose sensitive in-process information when a user open
An out-of-bounds read in Soda PDF Desktop's PDF parsing engine (build 14.0.509.23030) lets an attacker craft a malicious
Out-of-bounds read in Soda PDF Desktop 14.0.509.23030 enables remote attackers to disclose limited contents of process m
GitHub PoC
Exploit-DB