Soda PDF Desktop CVE-2025-14414

Exploitation requires the victim to open an attacker-crafted Word file in Soda PDF Desktop (version 14.0.509.23030 confirmed affected), or to visit a malicious page that induces opening such a file. The root cause is that Soda PDF Desktop executes dangerous script embedded in Word files WITHOUT presenting the user the warning that would normally gate such execution (CWE-356). The key limiting factor is the mandatory user interaction (UI:R): the attack cannot succeed without the target actively opening the malicious content, and it only yields code execution in the current user's security context - not elevated/system-level access. There is no network-service exposure and no default-configuration remote-unauthenticated path.

This is a moderate-severity client-side code execution flaw (CVSS 7.8) in Soda PDF Desktop, disclosed through Trend Micro's Zero Day Initiative (ZDI-25-1087, formerly ZDI-CAN-27496). The provided CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) tells a coherent story: exploitation requires no privileges but mandates user interaction, and the attack vector is Local because the victim must open a malicious Word file or visit a malicious page that delivers one. Note a common point of confusion: the description repeatedly calls the attackers 'remote,' yet the CVSS vector is correctly AV:L - this is not a conflict but the standard ZDI modeling for file-open bugs, where delivery may be remote but the exploitation primitive requires local file handling plus user action. No EPSS score, KEV listing, SSVC decision, or public POC was supplied in the input. Absent those signals, this reads as a credible but not urgent priority: a high technical impact (full C/I/A compromise in the current user's context) gated behind required user interaction, with no evidence of active exploitation or available exploit code. It warrants patching on a normal cycle rather than emergency response, and real-world risk hinges on social-engineering success rather than mass automated exploitation.

An attacker crafts a malicious Word file that abuses Soda PDF Desktop's handling of embedded/active script content, then delivers it via email attachment, download link, or a malicious web page. When the victim opens the file in Soda PDF Desktop, dangerous script executes without the expected user warning, running arbitrary code in the context of the current user. No public exploit code was identified in the provided data.