CVE-2025-14403
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning in the Launch action. User interaction is required, such as visiting a malicious page or opening a malicious file.
Risk Assessment
Opening a malicious document can lead to compromise of the user's privileges and arbitrary code execution. This poses a risk to organizations where users open files from untrusted sources.
Recommendation
Update PDFsam Enhanced to a patched version and restrict opening files from untrusted sources. Consider disabling or restricting the Launch action in the application configuration.
Other vulnerabilities in PDFsam Enhanced
See all- CVE-2025-14405Medium
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows physically-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system to exploit this vulnerability.
- CVE-2025-14404High
A vulnerability in PDFsam Enhanced when processing XLS files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
- CVE-2025-14402High
A vulnerability in PDFsam Enhanced when processing DOC files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
- CVE-2025-14401High
An Out-Of-Bounds Read vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current process. The flaw results from lack of proper validation of user-supplied data when handling App objects. User interaction is required, such as opening a malicious file.
Original NVD description (English source)
PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27500.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS