CVE-2025-14404
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in PDFsam Enhanced when processing XLS files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
Risk Assessment
Opening a malicious XLS file can lead to code execution and compromise of the user's privileges. This poses a risk to users who open files from untrusted sources.
Recommendation
Update PDFsam Enhanced to a patched version. Restrict opening XLS files from untrusted sources and consider running the application with limited privileges.
Other vulnerabilities in PDFsam Enhanced
See all- CVE-2025-14405Medium
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows physically-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system to exploit this vulnerability.
- CVE-2025-14403High
A vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning in the Launch action. User interaction is required, such as visiting a malicious page or opening a malicious file.
- CVE-2025-14402High
A vulnerability in PDFsam Enhanced when processing DOC files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
- CVE-2025-14401High
An Out-Of-Bounds Read vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current process. The flaw results from lack of proper validation of user-supplied data when handling App objects. User interaction is required, such as opening a malicious file.
Original NVD description (English source)
PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27498.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS