A high-severity local privilege escalation vulnerability in Soda PDF Desktop allows authenticated local attackers to achieve full SYSTEM compromise.

The application is vulnerable to an uncontrolled search path element flaw (CWE-427) within its OpenSSL configuration, where it attempts to load a configuration file from an insecure directory. An attacker with low-privileged access can leverage this to execute arbitrary code in the context of the SYSTEM account.

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains SYSTEM-level privileges. Given the CVSS score of 7.8, this represents a significant risk to organizational assets, potentially facilitating lateral movement, data exfiltration, or the deployment of ransomware across the local machine.

Immediate Action: Consult the vendor advisory and the Zero Day Initiative entry (ZDI-25-1079) to identify the specific patch version and update the software immediately.

Proactive Monitoring: Monitor system logs for unauthorized attempts to place or modify configuration files in application directories and audit process creation events for unusual child processes spawned by the Soda PDF service.

Compensating Controls: Restrict local user permissions to prevent unauthorized file system write access in directories used by the application and ensure the principle of least privilege is strictly enforced for all standard users.

Public Exploit Available: Unknown.

This vulnerability presents a critical risk to endpoints where Soda PDF Desktop is installed because it provides a direct path to full system takeover. Organizations should prioritize updating the software as soon as the vendor provides a patch and restrict local user access to the application installation paths to minimize the attack surface until remediation is complete.