CVE-2025-14404: PDFsam Enhanced XLS File RCE Vulnerability

CVE-2025-14404 Overview

CVE-2025-14404 is a remote code execution vulnerability in PDFsam Enhanced. The flaw resides in the application's processing of XLS files. PDFsam Enhanced allows execution of dangerous script content without displaying a user warning, contrary to the expectations documented in [CWE-356]. Attackers can leverage this weakness to execute arbitrary code in the context of the current user.

Exploitation requires user interaction. The target must open a malicious XLS file or visit a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-27498 and disclosed publicly in ZDI-25-1092.

Critical Impact
Attackers who convince a user to open a crafted XLS file gain arbitrary code execution with the privileges of that user.

Affected Products

PDFsam Enhanced version 7.0.76.15222
Earlier PDFsam Enhanced 7.x builds sharing the same XLS handling logic
Windows installations of PDFsam Enhanced with default configuration

Discovery Timeline

2025-12-23 - CVE-2025-14404 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14404

Vulnerability Analysis

The vulnerability stems from the way PDFsam Enhanced handles XLS spreadsheet files. When the application opens an XLS document, it processes embedded script content without prompting the user or applying sandboxing. This behavior maps to [CWE-356] Product UI does not Warn User of Unsafe Actions.

Most office productivity tools display an explicit warning before enabling macros or active content. PDFsam Enhanced bypasses this expected safety step. An attacker can craft an XLS file that carries executable script, deliver it through email or web download, and rely on the missing warning to trigger execution the moment the user opens the document.

Exploitation runs in the context of the currently logged-in user. That gives the attacker access to any files, credentials, and network resources reachable by that account. The CWE classification confirms the root issue is a user-interface safeguard failure rather than a memory corruption bug.

Root Cause

The root cause is the absence of an approval prompt or execution gate around script content inside XLS files. Code paths that parse spreadsheet content invoke the embedded scripting engine directly. No policy check distinguishes trusted files from untrusted attachments.

Attack Vector

The attack vector is local because the victim must open the file on the affected host. Delivery, however, is trivial through phishing, drive-by download, or shared network folders. Successful exploitation delivers high impact to confidentiality, integrity, and availability.

No public proof-of-concept exploit is currently available. Details on the flaw are documented in the Zero Day Initiative advisory ZDI-25-1092.

Detection Methods for CVE-2025-14404

Indicators of Compromise

Unexpected child processes spawned by the PDFsam Enhanced executable, especially script hosts such as wscript.exe, cscript.exe, powershell.exe, or cmd.exe.
XLS files arriving through email or download and opened directly by PDFsam Enhanced rather than by Microsoft Excel or LibreOffice Calc.
Outbound network connections initiated shortly after an XLS file is opened by the PDFsam Enhanced process.

Detection Strategies

Monitor process ancestry to flag any binary launched as a child of pdfsam-enhanced.exe that is not part of its normal runtime.
Alert on file writes to %APPDATA%, %TEMP%, or Startup folders originating from the PDFsam Enhanced process tree.
Correlate XLS file opens with subsequent script interpreter execution within a short time window.

Monitoring Recommendations

Enable command-line and script block logging on Windows endpoints to capture payload content when execution occurs.
Ingest endpoint process telemetry into a SIEM or data lake and build a rule for PDFsam Enhanced spawning interpreters.
Track user reports of PDFsam Enhanced opening XLS attachments so security teams can review associated files.

How to Mitigate CVE-2025-14404

Immediate Actions Required

Inventory all endpoints running PDFsam Enhanced and identify installations at version 7.0.76.15222 or earlier.
Instruct users to open XLS files only in dedicated spreadsheet applications, not in PDFsam Enhanced.
Block inbound XLS attachments at the mail gateway or apply quarantine rules until a vendor patch is installed.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Administrators should monitor the PDFsam website and the ZDI advisory ZDI-25-1092 for updates and apply the fixed release as soon as it becomes available.

Workarounds

Remove PDFsam Enhanced from systems where PDF workflows do not require it and rely on the open-source PDFsam Basic edition instead.
Configure file associations so that XLS files open in Microsoft Excel or LibreOffice Calc, where macro warnings are enforced.
Apply application allowlisting to prevent PDFsam Enhanced from spawning script interpreters such as powershell.exe or wscript.exe.

bash

# Windows example: block PDFsam Enhanced from launching PowerShell using WDAC or AppLocker
# Sample AppLocker rule condition (publisher rule scoped by parent process must be enforced via EDR)
New-AppLockerPolicy -RuleType Publisher -User Everyone -Action Deny \
  -FilePath "C:\\Program Files\\PDFsam Enhanced 7\\pdfsam-enhanced.exe"