Remote Code Execution Vulnerability in Soda PDF Desktop's Handling of Word Files
CVE-2025-14414

7.8HIGH

Key Information:

Vendor

Soda PDF

Status
Desktop
Vendor
CVE Published:
23 December 2025

What is CVE-2025-14414?

Soda PDF Desktop has a vulnerability in its handling of Word files that allows remote attackers to execute arbitrary code on user systems. This flaw arises from insufficient UI warning mechanisms that authorize the execution of potentially dangerous scripts without adequate user alerts. An attacker can exploit this vulnerability by crafting a malicious web page or file that, when accessed by the user, triggers the execution of the harmful code under the current user context. It is imperative for users to remain vigilant and avoid opening untrusted files.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Desktop 14.0.509.23030

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1087/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.