EUVD-2025-209419
GHSA-phj3-hcm2-mjhc
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.
AnalysisAI
Heap use-after-free in Nitro PDF Pro 14.41.1.4 for Windows allows local code execution via malicious PDF containing crafted JavaScript calling this.mailDoc(). The vulnerability stems from premature deallocation of an XID object whose freed pointer is passed to wcscmp() and other functions, where attacker-controlled strings in the freed heap region can manipulate program flow. CVSS 8.4 (AV:L/PR:N) indicates local attack vector requiring no privileges or user interaction. EPSS 0.01% suggests low immediate exploitation probability; no public exploit identified at time of analysis.
Technical ContextAI
Nitro PDF Pro implements JavaScript execution for PDF documents, including the non-standard this.mailDoc() method for email integration. The vulnerability (CWE-416: Use After Free) occurs when the JavaScript engine allocates an internal XID (cross-reference identifier) object during mailDoc() execution, then frees it prematurely while retaining the dangling pointer. Downstream UI rendering and logging functions receive this freed pointer and pass it to wcscmp() for wide-character string comparison. Because the freed heap region may contain remnants of attacker-controlled JavaScript strings from the PDF's embedded script, an attacker can influence the memory layout to cause the comparison routine to dereference attacker-influenced addresses. This violates memory safety assumptions in native code components handling JavaScript callbacks, a common attack surface in PDF reader implementations that bridge scripted and native execution contexts.
RemediationAI
No vendor-released patch identified at time of analysis. Users should monitor Nitro Software security advisories at nitro.com for forthcoming patches addressing CVE-2025-69627. Until a patch is available, implement defense-in-depth controls: disable JavaScript execution in Nitro PDF Pro (Options → JavaScript → Disable JavaScript) to eliminate the attack surface, though this may break legitimate PDF form functionality. Restrict PDF processing to trusted sources using application control policies. Deploy Nitro PDF Pro in sandboxed or virtualized environments to contain potential exploitation. For automated workflows, consider temporarily substituting alternative PDF processing tools that do not support JavaScript execution. Organizations should establish monitoring for abnormal crashes in NitroPDF.exe, particularly access violations in wcscmp() or heap management functions, as indicators of exploitation attempts. Refer to detailed vulnerability analysis at https://jeroscope.com/advisories/2025/jero-2025-016/ for technical indicators.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today