CVE-2025-14405
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows physically-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system to exploit this vulnerability.
Risk Assessment
An attacker must first obtain the ability to mount a malicious drive on the target system, but after exploitation can execute arbitrary code with SYSTEM privileges.
Recommendation
Update PDFsam Enhanced to a version containing the fix. Restrict the ability for unprivileged users to mount external drives.
Other vulnerabilities in PDFsam Enhanced
See all- CVE-2025-14404High
A vulnerability in PDFsam Enhanced when processing XLS files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
- CVE-2025-14403High
A vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning in the Launch action. User interaction is required, such as visiting a malicious page or opening a malicious file.
- CVE-2025-14402High
A vulnerability in PDFsam Enhanced when processing DOC files allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning. User interaction is required, such as opening a malicious file.
- CVE-2025-14401High
An Out-Of-Bounds Read vulnerability in PDFsam Enhanced allows remote attackers to execute arbitrary code in the context of the current process. The flaw results from lack of proper validation of user-supplied data when handling App objects. User interaction is required, such as opening a malicious file.
Original NVD description (English source)
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS