Soda PDF Desktop CVE-2025-14413

Exploitation requires the victim to open an attacker-supplied CBZ (comic book archive) file in Soda PDF Desktop, or visit a page that delivers one - the flaw lives specifically in Soda PDF Desktop's CBZ file-parsing routine, which fails to validate a user-supplied path before using it in file operations. No authentication or special configuration is needed (PR:N), and default installations are affected, but mandatory user interaction (UI:R) is the key limiting factor: there is no automatic or remote-without-interaction trigger. The attack runs in and is limited to the context/privileges of the current user (S:U), so impact does not inherently escalate to SYSTEM/root without a separate privilege-escalation step. Affected version confirmed is 14.0.509.23030.

This is a genuine but second-tier priority. The CVSS 3.0 base score of 7.8 (High) derives from a local attack vector (AV:L) with low complexity (AC:L) and no privileges required (PR:N) but mandatory user interaction (UI:R), yielding full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H, S:U) in the context of the current user. Despite PR:N, the AV:L + UI:R combination means this is NOT a remotely-triggerable server flaw - it is a client-side file-parsing bug that requires a victim to open a malicious CBZ file or visit a malicious page, which materially lowers real-world exploitability versus a network-reachable RCE. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable near-term mass exploitation. The lone source is a single ZDI advisory (ZDI-25-1086, ZDI-CAN-27509) reported by Trend Micro ZDI; this is a confirmed, vendor-coordinated finding rather than a speculative report. SSVC-style reading: exploitation status is 'none observed,' automatability is low (user interaction defeats automation), and technical impact is total - overall an 'act/track' rather than 'act now' disposition. In short, the severity rating is accurate for impact, but the practical risk is bounded by the social-engineering step required to deliver the malicious CBZ.

An attacker crafts a malicious CBZ (comic book ZIP archive) file containing entries with directory-traversal path names and either emails it to a victim or hosts it on a web page. When the user opens the file in Soda PDF Desktop, the unvalidated path is used in a file operation, writing attacker-controlled content outside the intended directory and leading to arbitrary code execution as the current user. No public exploit code was identified at time of analysis, though the ZDI advisory confirms a working proof-of-concept exists internally at the research team.