PT-2026-32376 · Nitro · Nitro Pro Pdf

Published 2026-04-13 · Updated 2026-04-13 · CVE-2025-69624

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nitro PDF Pro for Windows version 14.41.1.4

Description A NULL pointer dereference occurs in the JavaScript implementation of the app.alert() function. When app.alert() is called with multiple arguments and the first argument evaluates to null, the engine uses a fallback path for non-string arguments. In this process, the js ValueToString() function is called on the null value and returns an invalid string pointer, which is then passed to JS GetStringChars() without validation. This leads to an access violation and application crash when a crafted PDF is opened.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-69624

Affected Products

Nitro Pro Pdf

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-69624 · Security Note
• http://nitro.com · Note
• https://twitter.com/CVEnew/status/2043733076417884606 · Twitter Post