soda pdf vulnerabilities and fixes

Recent CVEs affecting soda pdf, with upgrade or downgrade steps. 8 tracked.

Also searched as: sodapdf.

soda pdf has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-12-23. Highest priority: CVE-2025-14415 (score 32/100).

• CVE-2025-14415 HIGH 7.8 DOWNGRADE Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14412 HIGH 7.8 DOWNGRADE Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14406 HIGH 7.8 DOWNGRADE Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
• CVE-2025-14409 HIGH 7.8 DOWNGRADE Soda PDF Desktop PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
• CVE-2025-14407 MEDIUM 5.5 DOWNGRADE Soda PDF Desktop PDF File Parsing Memory Corruption Information Disclosure Vulnerability
• CVE-2025-14410 MEDIUM 5.5 DOWNGRADE Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
• CVE-2025-14411 MEDIUM 5.5 DOWNGRADE Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
• CVE-2025-14408 LOW 3.3 DOWNGRADE Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

FAQ

How do I fix soda pdf vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is soda pdf being exploited right now?

None of the tracked soda pdf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which soda pdf CVE should I patch first?

CVE-2025-14415 currently ranks highest (32/100): Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability.

RSS feed for soda pdf · ← Back to latest CVEs