Vulnerability · Published Dec 23, 2025 · Assigned by zdi

CVE-2025-14405PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Medium 6.6

In plain English

A medium-severity uncontrolled search path in Enhanced from PDFsam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.0)6.6Medium

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867.

Affected products (as reported)

Vendor	Product	Versions
PDFsam	Enhanced	7.0.76.15222

Weakness: CWE-427 · Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

ZDI-25-1093 x_research-advisory