PT-2026-32377 · Nitro · Nitro Pro Pdf

Published 2026-04-13 · Updated 2026-04-13 · CVE-2025-69627

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nitro PDF Pro for Windows version 14.41.1.4

Description A heap use-after-free issue exists in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and freed prematurely, but the freed pointer is still passed to UI and logging helper functions. Consequently, routines such as wcscmp() may process invalid or stale pointers, which can lead to access violations and non-deterministic crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-69627

Affected Products

Nitro Pro Pdf

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-69627 · Security Note
• https://jeroscope.com/advisories/2025/jero-2025-016 · Note
• https://twitter.com/VulmonFeeds/status/2043780803834904684 · Twitter Post
• https://twitter.com/CVEnew/status/2043733077286162589 · Twitter Post
• http://nitro.com · Note