CVE-2025-14401
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An Out-Of-Bounds Read vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current process. The flaw results from lack of proper validation of user-supplied data when handling App objects. User interaction is required, such as opening a malicious file.
Risk Assessment
Opening a malicious document can lead to code execution and compromise of the application process. This poses a risk to users who open files from untrusted sources.
Recommendation
Update PDFsam Enhanced to a patched version. Restrict opening files from untrusted sources and consider running the application with limited privileges.
Other vulnerabilities in PDFsam Enhanced
See all- CVE-2025-14405Medium
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows physically-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system to exploit this vulnerability.
- CVE-2025-14404High
A vulnerability in PDFsam Enhanced when processing XLS files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
- CVE-2025-14403High
A vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning in the Launch action. User interaction is required, such as visiting a malicious page or opening a malicious file.
- CVE-2025-14402High
A vulnerability in PDFsam Enhanced when processing DOC files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
Original NVD description (English source)
PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27260.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS