SB2025121272 - Multiple vulnerabilities in PDFsam Enhanced
Published: December 12, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2025-14401)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the handling of App objects. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system, leading to arbitrary code execution.
2) Unquoted Search Path or Element (CVE-ID: CVE-2025-14405)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to unquoted search path or element within the configuration of OpenSSL. An authenticated attacker with physical access can execute arbitrary code on the system with elevated privileges.
3) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2025-14404)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient UI warning of dangerous operations within the processing of XLS files. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the system.
4) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2025-14403)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient UI warning of dangerous operations within the implementation of the Launch action. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the system.
5) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2025-14402)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient UI warning of dangerous operations within the processing of DOC files. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.