CVE-2025-14404CWE-356

CVE-2025-14404

High · published December 24, 2025

CVSS v3.0
7.0
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

⚡ A malicious XLS file is all it takes to unleash chaos! PDFsam Enhanced has a vulnerability that allows remote code execution if users accidentally visit the wrong page or open a harmful file. 🔥 Think of it like a restaurant that serves a dish without warning you about a hidden ingredient that could trigger allergies. In this case, the XLS file has a dangerous script tucked away inside, ready to execute once served! If someone falls for this trap, an attacker could execute arbitrary code in the context of the user's account. This could lead to anything from data theft to complete system compromise, making it a recipe for disaster!

Put simply

Think of it like a restaurant that serves a dish without warning you about a hidden ingredient that could trigger allergies. In this case, the XLS file has a dangerous script tucked away inside, ready to execute once served! This vulnerability arises from insufficient user interface warnings when processing XLS files, allowing attackers to run harmful scripts without alerting the user. Essentially, the software fails to warn about executing risky code that shouldn't be allowed.

What to do

If someone falls for this trap, an attacker could execute arbitrary code in the context of the user's account. This could lead to anything from data theft to complete system compromise, making it a recipe for disaster! To protect your systems, update PDFsam Enhanced to the latest version provided by the vendor. Educate users not to open files from untrusted sources and consider implementing additional security measures like file type restrictions. 🛡️ You can handle this! Stay vigilant, apply the updates, and you'll keep your digital environment safe from these sneaky attacks. 💪✨

The record
Technical detail
CVSS v3.0
7.0 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Weakness
CWE-356 · Product UI does not Warn User of Unsafe Actions
Published
2025-12-24T03:15Z
Affected products (1)
ProductVersionsFixed in
pdfsam/enhancedall versions—
References (1)
EPSS history
Timeline
  • 23 DEC 21:21Z
    PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability
    cvelistv5