EUVD-2025-209419
GHSA-phj3-hcm2-mjhc
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.
AnalysisAI
Heap use-after-free in Nitro PDF Pro 14.41.1.4 for Windows allows local code execution via malicious PDF containing crafted JavaScript calling this.mailDoc(). The vulnerability stems from premature deallocation of an XID object whose freed pointer is passed to wcscmp() and other functions, where attacker-controlled strings in the freed heap region can manipulate program flow. CVSS 8.4 (AV:L/PR:N) indicates local attack vector requiring no privileges or user interaction. EPSS 0.01% suggests low immediate exploitation probability; no public exploit identified at time of analysis.
Technical ContextAI
Nitro PDF Pro implements JavaScript execution for PDF documents, including the non-standard this.mailDoc() method for email integration. The vulnerability (CWE-416: Use After Free) occurs when the JavaScript engine allocates an internal XID (cross-reference identifier) object during mailDoc() execution, then frees it prematurely while retaining the dangling pointer. Downstream UI rendering and logging functions receive this freed pointer and pass it to wcscmp() for wide-character string comparison. Because the freed heap region may contain remnants of attacker-controlled JavaScript strings from the PDF's embedded script, an attacker can influence the memory layout to cause the comparison routine to dereference attacker-influenced addresses. This violates memory safety assumptions in native code components handling JavaScript callbacks, a common attack surface in PDF reader implementations that bridge scripted and native execution contexts.
RemediationAI
No vendor-released patch identified at time of analysis. Users should monitor Nitro Software security advisories at nitro.com for forthcoming patches addressing CVE-2025-69627. Until a patch is available, implement defense-in-depth controls: disable JavaScript execution in Nitro PDF Pro (Options → JavaScript → Disable JavaScript) to eliminate the attack surface, though this may break legitimate PDF form functionality. Restrict PDF processing to trusted sources using application control policies. Deploy Nitro PDF Pro in sandboxed or virtualized environments to contain potential exploitation. For automated workflows, consider temporarily substituting alternative PDF processing tools that do not support JavaScript execution. Organizations should establish monitoring for abnormal crashes in NitroPDF.exe, particularly access violations in wcscmp() or heap management functions, as indicators of exploitation attempts. Refer to detailed vulnerability analysis at https://jeroscope.com/advisories/2025/jero-2025-016/ for technical indicators.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today