EUVD-2025-211197
GHSA-hp4f-xh94-g7r6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PDF
-
DeliveryDeliver file to macOS user
-
ExploitVictim opens PDF in Nitro PDF Pro v14.7
-
ExecutionTrigger code injection (CWE-94)
-
ImpactExecute arbitrary code as the user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted PDF document in Nitro PDF Pro for macOS v14.7 (UI:R - user interaction is mandatory); there is no network-remote, zero-click path. Limiting factors: the attack is local/file-delivery (AV:L), depends on social engineering the user into opening the file, and is confined to the specific affected product and platform (Nitro PDF Pro on macOS). Code executes in the context of the user who opens the document. The precise parsing mechanism by which the crafted PDF achieves code injection is not described in the available sources. |
| Impact | Signals point to a moderate, non-urgent priority rather than a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3 HIGH) describes a local attack requiring user interaction but yielding full confidentiality, integrity, and availability impact via code injection (CWE-94). EPSS is low at 0.21% (10th percentile), indicating little evidence of broad active exploitation, and the vulnerability is NOT in CISA KEV - no public exploit identified as confirmed active exploitation. A public PoC reference exists (a GitHub gist by momenbasel); it is not verified as working exploit code, so POC availability should not be conflated with active exploitation. The vuln.today decision label is 'this_week', consistent with a real-but-contained issue warranting prompt patching rather than emergency response. Note a tension worth verifying: the description says 'local attacker' and CVSS uses AV:L, yet the attack vehicle is a crafted PDF opened by a victim (UI:R) - this is file-delivery execution in the victim's context, which argues for PR:N rather than the input's PR:L; verify the privilege assumption with the reporter/vendor. No SSVC automatable/technical-impact breakdown was supplied beyond the decision label. |
| Exploit ScenarioDerived | An attacker crafts a malicious PDF and delivers it to a macOS user (via email, download, or shared file) running Nitro PDF Pro v14.7. When the victim opens the document, injected code executes in the context of the user, giving the attacker arbitrary code execution. A public PoC reference exists (GitHub gist) but is not verified as working exploit code; the low AC and required user interaction mean reliable exploitation hinges on social engineering the victim into opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Arbitrary code execution in Nitro PDF Pro for macOS 14.7 lets an attacker who can deliver a crafted PDF file run code in the context of the user who opens it. The assessed vector is local (AV:L) with mandatory user interaction (UI:R), so there is no zero-click or network-remote path - exploitation depends on social-engineering the victim into opening a malicious document, and the precise parsing mechanism that yields code injection is not described in the available sources. Exploitation has not been confirmed as active (not in CISA KEV), a public gist reference exists but is not verified as working exploit code, and EPSS is low at 0.21% (10th percentile), which together with the vuln.today 'this_week' decision label points to a moderate, non-urgent priority rather than a top-tier emergency.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the first step is to check Nitro (http://nitro.com) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-45528) for an updated macOS build and upgrade to it as soon as one is published. Until then, the exposure is driven by the local file-delivery and user-interaction prerequisites: treat untrusted or unsolicited PDFs as the attack vector and avoid opening them in Nitro PDF Pro on macOS 14.7, using an alternative viewer for such files - the trade-off is loss of Nitro's editing features for those documents. Because code executes in the context of the user who opens the document, running Nitro PDF Pro from a non-privileged macOS account limits what an exploit can reach, at the cost of not having administrative access inside the app. Blocking inbound PDF delivery at mail and web gateways reduces the social-engineering surface but will not stop files arriving by other channels, and it carries the usual risk of false positives on legitimate attachments.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-94 (Improper Control of Generation of Code / code injection) in the PDF-handling stack of Nitro PDF Pro for macOS, meaning untrusted content in a document is able to influence executable code paths rather than being confined to data handling. Per the assessed CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the attack is delivered as a local file rather than over the network, needs the user to open the crafted PDF, and yields high confidentiality and integrity impact within the application's user context (no scope change). Note that the NVD-supplied base vector records PR:L while the independent assessment records PR:N; the practical prerequisite in both readings is that the attacker gets a malicious PDF in front of the victim and the victim opens it - the trigger and the specific parser or component involved are not described in the available sources. No CPE data was supplied, so affected-product identification rests on the vendor/platform statement (Nitro PDF Pro, macOS, v14.7) rather than on formal CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
File-delivery execution in the victim's context needs no attacker privileges (PR:N, diverging from the input's PR:L); AV:L and UI:R because a user must open a local crafted PDF, with full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
Executive ViewAI
Nitro PDF Pro for macOS contains a high-severity code execution vulnerability (CVE-2025-45528) that could allow an attacker to run malicious code on a user's machine if they are tricked into opening a specially crafted PDF file. This affects organizations where employees use this PDF software, potentially leading to data compromise or further network intrusion, though exploitation requires user interaction and no active attacks have been confirmed. Leadership should prioritize patching and user awareness to mitigate risk.
No vendor-released patch identified at time of analysis; implement user awareness training, email filtering, and application allowlisting to reduce risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB