Soda PDF Desktop CVE-2025-14411

Exploitation requires the victim to open an attacker-crafted PDF in Soda PDF Desktop (build 14.0.509.23030 per the CPE) or visit a malicious page that serves such a file - the flaw is in the application's PDF file-parsing path and triggers an out-of-bounds read when user-supplied PDF data is not properly validated. Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - the target must actively open the malicious file), a local attack vector (AV:L - no remote network service is exposed), and the fact that this yields only an information leak (C:H, I:N, A:N) unless chained with a separate memory-corruption bug to achieve code execution.

This is a genuinely moderate, not high-priority, issue and the signals are largely consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes a local-vector, user-interaction-dependent information-disclosure flaw with high confidentiality impact but no integrity or availability impact - appropriate for an out-of-bounds read (CWE-125) triggered by opening a malicious PDF. Note a wording tension to verify: the NVD description states 'remote attackers' while the CVSS vector is AV:L; this is the standard ZDI file-parsing convention (the vector is 'local' because the victim must open an attacker-supplied file locally, even though the file is delivered remotely), not a true remote-network vector, so treat it as attacker-supplies-file/local-trigger. Exploitation likelihood is low: EPSS is 0.18% (7th percentile), the CVE is not on CISA KEV, and no public exploit was identified in the provided data - no public exploit identified at time of analysis. The 'RCE' and 'Buffer Overflow' tags overstate the standalone impact: by itself this is an info-disclosure (memory read), and arbitrary code execution is only possible 'in conjunction with other vulnerabilities' per the description. Overall: a legitimate but low-urgency client-side bug whose main value to an attacker is as an info-leak primitive (e.g., ASLR defeat) in a larger exploit chain, not a standalone widespread threat.

An attacker crafts a malicious PDF and lures a Soda PDF Desktop user into opening it (via email attachment, download, or a malicious web page). When Soda PDF parses the malformed file, the flaw causes a read past the end of an allocated object, leaking adjacent process memory back to data the attacker can observe or chain. No public proof-of-concept was identified at time of analysis, and the high confidentiality / no-availability impact plus required user interaction make this most useful as an information-leak step within a broader exploit chain rather than a standalone compromise.