Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14412: Soda PDF Desktop: Malicious XLS Files Can Execute Code Remotely

CVE-2025-14412 · published 10 months ago

Summary

An attacker can trick a Soda PDF Desktop user into opening a malicious Excel file, allowing the attacker to run code on the user's computer. This can happen if the user visits a malicious website or opens a malicious file. To protect yourself, do not open files from unknown sources, and be cautious when clicking on links.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sodapdf	soda_pdf	14.0.509.23030 `cpe:2.3:a:sodapdf:soda_pdf:14.0.509.23030:::::::*`

Original advisory text

Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27495.

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1085/ Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-356Product UI does not Warn User of Unsafe Actions

Timeline

Published23 Dec 2025

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-14412 · NVD

Track software like this

Free during beta