Soda PDF Desktop CVE-2025-14412

Exploitation requires the victim to open an attacker-crafted XLS file (or visit a page that serves one) specifically within Soda PDF Desktop version 14.0.509.23030; the root cause is that the application executes embedded dangerous script from the XLS without displaying its normal security warning (CWE-356: insufficient UI warning). The decisive limiting factor is mandatory user interaction (UI:R) - the file must be deliberately opened - so there is no unauthenticated network-triggered path; this is a local, social-engineering-dependent attack (AV:L). Code executes only at the privilege level of the current user, not SYSTEM/root.

This is a client-side, file-format remote code execution flaw in Soda PDF Desktop, disclosed through Trend Micro's Zero Day Initiative (ZDI-25-1085 / ZDI-CAN-27495). The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) is internally consistent with the description: although the summary says 'remote attackers,' the attack vector is correctly scored Local (AV:L) because the victim must open a malicious XLS file or visit a page that delivers one - ZDI scores such user-opened-file cases as local, so there is no contradiction here, just a wording nuance ('remote' refers to attacker origin, not network reachability). PR:N means no authentication is required, but UI:R (user interaction required) is the dominant limiting factor and prevents hands-off, wormable exploitation. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; risk is therefore driven by severity potential rather than demonstrated in-the-wild use. Net assessment: a genuinely high-impact bug (full code execution as the current user) but gated behind social engineering, affecting a non-ubiquitous consumer/SMB product - a moderate real-world priority, below internet-facing unauthenticated RCEs, roughly comparable to other 'open a malicious document' client-side flaws. EPSS and exploitation telemetry are MISSING; treat exploitation likelihood as unquantified.

An attacker crafts a malicious XLS file that embeds dangerous script which Soda PDF Desktop executes without presenting the expected security warning, then delivers it via phishing email or a lure web page. When the victim opens the file in Soda PDF Desktop, arbitrary code runs in the context of that user. Given AV:L/AC:L, exploitation is low-complexity once the file is opened, but no public proof-of-concept was identified at time of analysis.