Soda PDF Desktop Remote Code Execution Vulnerability via Malicious XLS Files

A remote code execution vulnerability has been identified in Soda PDF Desktop. This issue arises from insufficient user interface warnings when handling XLS files, allowing the execution of harmful scripts without proper notification. As a result, remote attackers can execute arbitrary code on the affected system, using the privileges of the current user. Exploitation requires user interaction, such as opening a malicious XLS file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current user.

Remediation

Users are advised to limit interactions with Soda PDF Desktop, especially when dealing with XLS files, to mitigate the risk of exploitation.