Soda PDF Desktop CVE-2025-14415

Exploitation requires the victim to open an attacker-crafted PDF (or visit a page serving one) in Soda PDF Desktop; the flaw lies in the Launch action implementation, which executes dangerous embedded scripts/commands without displaying the security warning a user would normally need to approve. Key limiting factors: mandatory user interaction (UI:R) - the target must actively open the malicious file - and code runs only in the current user's context (no privilege escalation, S:U), so impact is bounded by the victim's existing permissions. This is a client-side document-processing issue, not a remotely reachable network service.

This is a genuine but user-interaction-gated client-side risk rather than a drive-by remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) correctly models it as local attack vector requiring the victim to open a malicious file, with no privileges needed and full C/I/A impact in the current user's context. Note the apparent tension between the prose ('remote attackers') and the vector's AV:L: ZDI classifies file-/page-triggered vulnerabilities as AV:L because the malicious artifact must be processed locally, so 'remote' here means attacker-supplied content, not network-reachable service - defenders should treat this as a phishing/malicious-document threat, not a server exposure. No EPSS score, KEV listing, or POC was provided in the input; per precedent this is 'no public exploit identified at time of analysis.' Absence of exploitation signals plus a required-user-interaction constraint places this below network-unauthenticated RCEs in priority, though the CWE-356 (missing security warning on the dangerous Launch action) means a single careless click yields code execution with no further barriers.

An attacker crafts a PDF containing a Launch action that invokes a malicious script or executable and delivers it via phishing email or a malicious web page. When the victim opens the document in Soda PDF Desktop, the Launch action executes without the expected user warning, running attacker code in the victim's user context. No public exploit code is identified in the provided data, so exploitation would currently require an attacker to independently develop the malicious document.