What is the CVSS score of CVE-2025-66769?

CVE-2025-66769 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2025-66769?

Nitro PDF Pro for Windows version 14.41.1.4 is vulnerable to denial-of-service attacks through maliciously crafted PDF files that trigger application crashes.

How to fix or mitigate CVE-2025-66769?

Within 24 hours: Identify and inventory all Nitro PDF Pro 14.41.1.4 installations across the organization using asset management tools. Within 7 days: Issue user advisory restricting opening of PDFs from untrusted sources and monitor Nitro vendor website for patch release. Within 30 days: Deploy patched version once released by vendor (monitor for version 14.41.2 or later), or implement application sandboxing/containerization for PDF processing as interim mitigation if patch remains unavailable.

N A CVE-2025-66769

EUVD-2025-209415 HIGH

NULL Pointer Dereference (CWE-476)

2026-04-13 mitre

GHSA-hf73-7qvc-m78v

Denial Of Service Null Pointer Dereference Microsoft N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:29 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (None) 7.5 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 15:45 euvd

EUVD-2025-209415

Analysis Generated

Apr 13, 2026 - 15:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.

AnalysisAI

Nitro PDF Pro for Windows version 14.41.1.4 crashes when processing maliciously crafted XFA (XML Forms Architecture) packets due to a NULL pointer dereference, enabling remote denial-of-service attacks without authentication. An attacker can deliver a weaponized PDF containing the crafted XFA packet, causing the application to terminate when opened. EPSS exploitation probability is very low (0.01%, 2nd percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis. Despite CVSS 7.5 (High), real-world risk is limited to availability impact only - no code execution, data theft, or privilege escalation possible.

Technical ContextAI

XFA (XML Forms Architecture) is an Adobe XML-based form specification embedded in PDF documents, used for dynamic form rendering and data processing. Nitro PDF Pro's XFA parser fails to validate pointer references before dereferencing them when processing specially crafted XFA packet structures. CWE-476 (NULL Pointer Dereference) occurs when code attempts to access memory via a pointer that has not been initialized or has been explicitly set to NULL, typically causing immediate application crashes on modern operating systems with memory protection. The vulnerability exists in the parsing logic that handles XFA elements within PDF documents, likely during the deserialization or DOM construction phase when the application processes the XFA template stream. No CPE product identifier was provided beyond generic placeholder values, but the vulnerability specifically affects Nitro PDF Pro version 14.41.1.4 for Windows platforms.

RemediationAI

Upgrade Nitro PDF Pro to the latest version available from the vendor at https://www.gonitro.com/, verifying the release notes confirm resolution of CVE-2025-66769 or XFA parsing vulnerabilities. No vendor-released patch or specific fix version number was identified in available data sources at time of analysis. As interim mitigation, organizations can implement PDF file scanning/sanitization at email gateways to detect and strip XFA content from incoming documents, deploy application-level firewall rules to monitor Nitro PDF Pro process behavior for abnormal terminations, or consider alternative PDF readers that do not support XFA rendering for users who do not require dynamic forms functionality. Restrict processing of PDFs from untrusted sources and educate users on the risks of opening unsolicited PDF attachments, particularly those claiming to contain interactive forms.