CVE Feed

    Dashboard / CVE / CVE-2025-69627

    CVE-2025-69627

    Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.

    Published:Apr 13, 2026
    Last Modified:Apr 23, 2026
    EPS:Apr 13, 2026
    EPSS Score:0.00007
    CVSS Score:8.4

    Affected Products

    Vendor
    Gonitro
    Product
    Nitro Pdf Pro
    Vendor
    Microsoft
    Product
    Windows
    Vendor
    Nitro
    Product
    Pdf Pro

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-416 Use After Free

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-69624 (CVSS 7.5) — Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript imp…
    CVE-2025-66769 (CVSS 7.5) — A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Servi…
    CVE-2025-67825 (CVSS 5.5) — An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it displays signer i…
    CVE-2024-35288 (CVSS 7.8) — Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Install…
    CVE-2016-8713 (CVSS 7.8) — A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro…
    CVE-2016-8709 (CVSS 7.8) — A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro…
    CVE-2016-8711 (CVSS 7.8) — A potential remote code execution vulnerability exists in the PDF parsing functionality of Nitro Pro 10. A spe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High