Local Privilege Escalation Risk in Soda PDF Desktop by Visual Tools

CVE-2025-14406

What is CVE-2025-14406?

The vulnerability in Soda PDF Desktop resides in its handling of the OpenSSL configuration file, allowing local attackers to exploit it by executing low-privileged code. By leveraging the unsecured path from which the configuration file is loaded, an attacker can escalate privileges and run arbitrary code with SYSTEM permissions on the target system, posing significant security risks. This highlights the need for proper configuration and security measures to prevent unauthorized access and privilege escalation.

References