CVE-2025-14408

A vulnerability in Soda PDF Desktop allows remote attackers to execute arbitrary code in the context of the current user. The flaw results from allowing dangerous script execution without user warning in the Launch action. User interaction is required, such as visiting a malicious page or opening a malicious file.

A vulnerability in Soda PDF Desktop allows remote code execution when handling Word files. The flaw results from allowing execution of dangerous scripts without user warning. Exploitation requires user interaction (opening a malicious file or visiting a malicious page).

A vulnerability in Soda PDF Desktop's CBZ file parsing involves lack of validation of a user-supplied path before file operations, enabling directory traversal. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current user.

A vulnerability in Soda PDF Desktop allows remote attackers to execute arbitrary code. It requires user interaction (visiting a malicious page or opening a malicious file) and results from allowing dangerous script execution without user warning when handling XLS files.

Soda PDF Desktop contains an out-of-bounds read during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

Soda PDF Desktop contains an out-of-bounds read during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

A vulnerability in Soda PDF Desktop allows remote attackers to execute arbitrary code. It requires user interaction (visiting a malicious page or opening a malicious file) and results from lack of proper validation of user-supplied data during PDF parsing, leading to an out-of-bounds write.

Soda PDF Desktop contains a memory corruption issue during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

Soda PDF Desktop contains a local privilege escalation vulnerability due to an uncontrolled search path element. The application loads an OpenSSL configuration file from an unsecured location, allowing an attacker with low-privileged code execution to run arbitrary code as SYSTEM.