CVE-2025-14403CWE-356

CVE-2025-14403

High · published December 24, 2025

CVSS v3.0
7.8
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

⚡ A crafty attacker can launch arbitrary code simply by luring users to a malicious page or file! This remote code execution vulnerability in PDFsam Enhanced might sound technical, but it puts your system at serious risk! Think of it like a restaurant where the chef leaves the kitchen door unlocked. If someone sneaks in and cooks up a dangerous dish, unsuspecting diners could eat it without even knowing! In this case, the Launch action allows potentially harmful scripts to run without user warnings, leaving the door wide open for bad actors. If exploited, an attacker could execute their malicious code in the context of the current user, leading to unauthorized access, data theft, or even total system compromise. Imagine an intruder rummaging through your kitchen, cooking up a storm with very little resistance! It's a high-stakes scenario that no one wants to face.

Put simply

Think of it like a restaurant where the chef leaves the kitchen door unlocked. If someone sneaks in and cooks up a dangerous dish, unsuspecting diners could eat it without even knowing! In this case, the Launch action allows potentially harmful scripts to run without user warnings, leaving the door wide open for bad actors. This vulnerability occurs due to insufficient user interface warnings when executing potentially harmful scripts through the Launch action in PDFsam Enhanced, allowing remote code execution if a user interacts with a malicious link or file.

What to do

If exploited, an attacker could execute their malicious code in the context of the current user, leading to unauthorized access, data theft, or even total system compromise. Imagine an intruder rummaging through your kitchen, cooking up a storm with very little resistance! It's a high-stakes scenario that no one wants to face. To protect yourself, update PDFsam Enhanced to the latest version as soon as possible to eliminate this flaw. Additionally, educate users about the risks of opening files from unknown sources and consider implementing stricter security measures around file handling. Don't wait—act before it's too late! This is fixable! By taking these steps, you can keep your system secure and earn those security hero badges! 🦸

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-356 · Product UI does not Warn User of Unsafe Actions
Published
2025-12-24T03:15Z
Affected products (1)
ProductVersionsFixed in
pdfsam/enhancedall versions—
References (1)
EPSS history
Timeline
  • 23 DEC 21:21Z
    PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability
    cvelistv5