EUVD-2025-209419
GHSA-phj3-hcm2-mjhc
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.
AnalysisAI
Heap use-after-free in Nitro PDF Pro 14.41.1.4 for Windows allows local code execution via malicious PDF containing crafted JavaScript calling this.mailDoc(). The vulnerability stems from premature deallocation of an XID object whose freed pointer is passed to wcscmp() and other functions, where attacker-controlled strings in the freed heap region can manipulate program flow. CVSS 8.4 (AV:L/PR:N) indicates local attack vector requiring no privileges or user interaction. EPSS 0.01% suggests low immediate exploitation probability; no public exploit identified at time of analysis.
Technical ContextAI
Nitro PDF Pro implements JavaScript execution for PDF documents, including the non-standard this.mailDoc() method for email integration. The vulnerability (CWE-416: Use After Free) occurs when the JavaScript engine allocates an internal XID (cross-reference identifier) object during mailDoc() execution, then frees it prematurely while retaining the dangling pointer. Downstream UI rendering and logging functions receive this freed pointer and pass it to wcscmp() for wide-character string comparison. Because the freed heap region may contain remnants of attacker-controlled JavaScript strings from the PDF's embedded script, an attacker can influence the memory layout to cause the comparison routine to dereference attacker-influenced addresses. This violates memory safety assumptions in native code components handling JavaScript callbacks, a common attack surface in PDF reader implementations that bridge scripted and native execution contexts.
RemediationAI
No vendor-released patch identified at time of analysis. Users should monitor Nitro Software security advisories at nitro.com for forthcoming patches addressing CVE-2025-69627. Until a patch is available, implement defense-in-depth controls: disable JavaScript execution in Nitro PDF Pro (Options → JavaScript → Disable JavaScript) to eliminate the attack surface, though this may break legitimate PDF form functionality. Restrict PDF processing to trusted sources using application control policies. Deploy Nitro PDF Pro in sandboxed or virtualized environments to contain potential exploitation. For automated workflows, consider temporarily substituting alternative PDF processing tools that do not support JavaScript execution. Organizations should establish monitoring for abnormal crashes in NitroPDF.exe, particularly access violations in wcscmp() or heap management functions, as indicators of exploitation attempts. Refer to detailed vulnerability analysis at https://jeroscope.com/advisories/2025/jero-2025-016/ for technical indicators.
Share
External POC / Exploit Code
Leaving vuln.today