CVE-2025-14402: PDFsam Enhanced RCE Vulnerability

CVE-2025-14402 Overview

CVE-2025-14402 is a remote code execution vulnerability in PDFsam Enhanced affecting the processing of DOC files. The flaw stems from the application allowing execution of dangerous script content without presenting a user warning [CWE-356]. Attackers can leverage this weakness to execute arbitrary code in the context of the current user when a victim opens a crafted document or visits a malicious page. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-27499 and tracked publicly as ZDI-25-1090. Exploitation requires user interaction, which limits drive-by scenarios but aligns with realistic phishing workflows.

Critical Impact
Successful exploitation of CVE-2025-14402 allows attackers to execute arbitrary code as the current user, enabling installation of malware, credential theft, and lateral movement from a single opened DOC file.

Affected Products

PDFsam Enhanced 7.0.76.15222
Vendor: pdfsam
Component: pdfsam:enhanced

Discovery Timeline

2025-12-23 - CVE-2025-14402 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14402

Vulnerability Analysis

The vulnerability resides in the DOC file processing logic of PDFsam Enhanced. When the application parses a DOC document containing embedded scripts or active content, it fails to prompt the user before executing that content. This represents a User Interface (UI) Misrepresentation of Critical Information weakness classified under [CWE-356]. Because the security boundary depends on informed user consent, removing the warning collapses the trust model. The attacker delivers a weaponized DOC file through email, web download, or shared storage. Once opened in PDFsam Enhanced, the embedded payload runs with the privileges of the logged-in user, bypassing the warning dialog that would normally alert the victim.

Root Cause

The root cause is insufficient UI warning before executing dangerous script content embedded in DOC files. The application processes active content without surfacing a security prompt, which removes the user's opportunity to refuse execution. This contradicts the standard handling pattern used by mainstream office productivity applications, which gate macro and script execution behind explicit user approval.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious DOC file and convinces a target to open it in PDFsam Enhanced or visit a page that triggers the file handler. The high attack complexity reflects conditions outside the attacker's direct control, such as social engineering success and victim software configuration. Refer to the Zero Day Initiative Advisory ZDI-25-1090 for additional technical context.

Detection Methods for CVE-2025-14402

Indicators of Compromise

Unexpected child processes spawned by the PDFsam Enhanced executable, particularly script interpreters such as cmd.exe, powershell.exe, or wscript.exe.
DOC files arriving from untrusted email senders or downloads that target users running PDFsam Enhanced 7.0.76.15222.
Outbound network connections initiated shortly after a DOC file is opened in PDFsam Enhanced.

Detection Strategies

Monitor process lineage where PDFsam Enhanced is the parent process and the child is a scripting or shell binary.
Alert on writes to user-writable persistence locations such as Run registry keys and Startup folders immediately following PDFsam Enhanced activity.
Correlate file open events for .doc and .docx extensions handled by PDFsam Enhanced with subsequent process creation telemetry.

Monitoring Recommendations

Track endpoint telemetry for PDFsam Enhanced version 7.0.76.15222 across managed systems to identify exposed hosts.
Forward process creation, file write, and network connection events to a centralized analytics platform for correlation.
Establish a behavioral baseline for PDFsam Enhanced and flag deviations such as unexpected DLL loads or network traffic.

How to Mitigate CVE-2025-14402

Immediate Actions Required

Inventory all systems running PDFsam Enhanced version 7.0.76.15222 and prioritize them for remediation.
Restrict opening of DOC files from untrusted sources and route them through a sandboxed inspection workflow.
Communicate the risk to end users and instruct them to avoid opening unsolicited DOC attachments in PDFsam Enhanced.

Patch Information

At the time of publication, no vendor advisory URL is listed in NVD. Monitor the Zero Day Initiative Advisory ZDI-25-1090 and the PDFsam vendor site for an updated build that addresses CVE-2025-14402. Apply the fixed version as soon as it is released.

Workarounds

Reassign the default handler for .doc files to a hardened office application that prompts before executing active content.
Block inbound DOC attachments at the email gateway or rewrite them to a safe format such as PDF.
Apply application allowlisting to prevent PDFsam Enhanced from launching child processes like powershell.exe or cmd.exe.

bash

# Example Windows application control rule fragment
# Deny PDFsam Enhanced from spawning script interpreters
New-AppLockerPolicy -RuleType Deny `
  -User Everyone `
  -Path "%PROGRAMFILES%\PDFsam Enhanced\*" `
  -RuleCollection Script