CVE-2025-14412
📋 TL;DR
This vulnerability in Soda PDF Desktop allows remote attackers to execute arbitrary code by tricking users into opening malicious XLS files. The software fails to provide adequate warnings about dangerous script execution within these files. All users running vulnerable versions of Soda PDF Desktop are affected.
💻 Affected Systems
- Soda PDF Desktop
📦 What is this software?
Soda Pdf by Sodapdf
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer, data theft, ransomware deployment, and lateral movement within the network.
Likely Case
Malware installation, credential theft, and data exfiltration from the compromised user's account.
If Mitigated
Limited impact due to application sandboxing, user privilege restrictions, or network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires user interaction but is technically simple once malicious file is opened. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-1085/
Restart Required: Yes
Instructions:
1. Open Soda PDF Desktop
2. Navigate to Help > Check for Updates
3. Install available updates
4. Restart the application
🔧 Temporary Workarounds
Disable XLS file association
windowsPrevent Soda PDF from automatically opening XLS files
1. Right-click any XLS file
2. Select 'Open with' > 'Choose another app'
3. Select a different application (e.g., Excel)
4. Check 'Always use this app to open .xls files'
Block XLS files at perimeter
allPrevent malicious XLS files from reaching users
🧯 If You Can't Patch
- Restrict user privileges to standard user accounts (not administrator)
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Soda PDF Desktop version against vendor's patched version listCheck Version:
Open Soda PDF Desktop > Help > AboutVerify Fix Applied:
Verify Soda PDF Desktop version is updated to patched version📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Soda PDF
- Multiple XLS file openings from untrusted sources
- Soda PDF crashing with memory-related errors
Network Indicators:
- Outbound connections from Soda PDF to unknown IPs
- DNS requests for suspicious domains following XLS file opening
SIEM Query:
Process Creation where ParentImage contains 'SodaPDF' and CommandLine contains '.xls'