CVE-2025-69624

Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is called with more than one argument and the first argument evaluates to null (for example, app.alert(app.activeDocs, true) when app.activeDocs is null), the engine routes the call through a fallback path intended for non-string arguments. In this path, js_ValueToString() is invoked on the null value and returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation. Dereferencing this pointer leads to an access violation and application crash when opening a crafted PDF. For example, 14.41.1.4 and 14.42.0.34 have been reported as vulnerable.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.gonitro.com/documentation/release-notes

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:gonitro:nitro_pdf_pro:14.41.1.4:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

15 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Nitro PDF Pro para Windows 14.41.1.4 contiene una vulnerabilidad de desreferencia de puntero NULL en la implementación JavaScript de app.alert(). Cuando se llama a app.alert() con más de un argumento y el primer argumento se evalúa como nulo (por ejemplo, app.alert(app.activeDocs, true) cuando app.activeDocs es nulo), el motor enruta la llamada a través de una ruta de respaldo destinada a argumentos que no son cadenas. En esta ruta, se invoca js_ValueToString() sobre el valor nulo y devuelve un puntero de cadena no válido, que luego se pasa a JS_GetStringChars() sin validación. La desreferencia de este puntero conduce a una violación de acceso y a un bloqueo de la aplicación al abrir un PDF manipulado.

Information

Published : 2026-04-13 16:16

Updated : 2026-10-15 12:10

NVD link : CVE-2025-69624

Mitre link : CVE-2025-69624

CVE.ORG link : CVE-2025-69624

JSON object : View

Products Affected

gonitro

nitro_pdf_pro

microsoft

windows

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-69624", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69624", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T19:01:09.748340Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-04-13T16:16:24.740", "references": [{"url": "https://www.gonitro.com/documentation/release-notes", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is called with more than one argument and the first argument evaluates to null (for example, app.alert(app.activeDocs, true) when app.activeDocs is null), the engine routes the call through a fallback path intended for non-string arguments. In this path, js_ValueToString() is invoked on the null value and returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation. Dereferencing this pointer leads to an access violation and application crash when opening a crafted PDF. For example, 14.41.1.4 and 14.42.0.34 have been reported as vulnerable."}, {"lang": "es", "value": "Nitro PDF Pro para Windows 14.41.1.4 contiene una vulnerabilidad de desreferencia de puntero NULL en la implementaci\u00f3n JavaScript de app.alert(). Cuando se llama a app.alert() con m\u00e1s de un argumento y el primer argumento se eval\u00faa como nulo (por ejemplo, app.alert(app.activeDocs, true) cuando app.activeDocs es nulo), el motor enruta la llamada a trav\u00e9s de una ruta de respaldo destinada a argumentos que no son cadenas. En esta ruta, se invoca js_ValueToString() sobre el valor nulo y devuelve un puntero de cadena no v\u00e1lido, que luego se pasa a JS_GetStringChars() sin validaci\u00f3n. La desreferencia de este puntero conduce a una violaci\u00f3n de acceso y a un bloqueo de la aplicaci\u00f3n al abrir un PDF manipulado."}], "lastModified": "2026-10-15T12:10:00.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gonitro:nitro_pdf_pro:14.41.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7223A11-A180-47D4-AD94-7C184636BDC3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}