Soda Pdf Desktop
Monthly
Code execution in Soda PDF Desktop 14.0.509.23030 is possible when a user opens an attacker-crafted Word file, because the application runs dangerous embedded script without the expected UI warning. The attack is client-side and requires user interaction (UI:R), and any code runs only with the current user's privileges rather than elevated or system-level rights. No public exploit code or confirmed active exploitation was identified at time of analysis.
Directory traversal in Soda PDF Desktop 14.0.509.23030's CBZ parser can lead to arbitrary code execution when a user opens a crafted comic-book archive, with impact limited to that user's privileges. The flaw requires user interaction and no special privileges, making it a genuine but second-tier risk rather than an automatically exploitable remote compromise; the provided intelligence contains no public exploit code or CISA KEV confirmation.
Code execution in Soda PDF Desktop 14.0.509.23030 is possible when a user opens an attacker-crafted Word file, because the application runs dangerous embedded script without the expected UI warning. The attack is client-side and requires user interaction (UI:R), and any code runs only with the current user's privileges rather than elevated or system-level rights. No public exploit code or confirmed active exploitation was identified at time of analysis.
Directory traversal in Soda PDF Desktop 14.0.509.23030's CBZ parser can lead to arbitrary code execution when a user opens a crafted comic-book archive, with impact limited to that user's privileges. The flaw requires user interaction and no special privileges, making it a genuine but second-tier risk rather than an automatically exploitable remote compromise; the provided intelligence contains no public exploit code or CISA KEV confirmation.