CVE-2025-14415

A vulnerability in Soda PDF Desktop allows remote code execution when handling Word files. The flaw results from allowing execution of dangerous scripts without user warning. Exploitation requires user interaction (opening a malicious file or visiting a malicious page).

A vulnerability in Soda PDF Desktop's CBZ file parsing involves lack of validation of a user-supplied path before file operations, enabling directory traversal. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current user.

A vulnerability in Soda PDF Desktop allows remote attackers to execute arbitrary code. It requires user interaction (visiting a malicious page or opening a malicious file) and results from allowing dangerous script execution without user warning when handling XLS files.

Soda PDF Desktop contains an out-of-bounds read during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

Soda PDF Desktop contains an out-of-bounds read during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

A vulnerability in Soda PDF Desktop allows remote attackers to execute arbitrary code. It requires user interaction (visiting a malicious page or opening a malicious file) and results from lack of proper validation of user-supplied data during PDF parsing, leading to an out-of-bounds write.

A vulnerability in Soda PDF Desktop during PDF file parsing allows out-of-bounds read and information disclosure. It requires user interaction (visiting a malicious page or opening a malicious file). It can be exploited in conjunction with other vulnerabilities to execute code.

Soda PDF Desktop contains a memory corruption issue during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

Soda PDF Desktop contains a local privilege escalation vulnerability due to an uncontrolled search path element. The application loads an OpenSSL configuration file from an unsecured location, allowing an attacker with low-privileged code execution to run arbitrary code as SYSTEM.