What is the CVSS score of EUVD-2025-209417?

EUVD-2025-209417 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by EUVD-2025-209417?

Nitro PDF Pro 14.41.1.4 for Windows is vulnerable to a denial-of-service attack triggered by malicious PDF files that crash the application without user authentication or interaction.

How to fix or mitigate EUVD-2025-209417?

Within 24 hours: Inventory all Nitro PDF Pro installations and document current versions in use. Within 7 days: Issue user communication advising caution with PDFs from untrusted sources and implement file-type restrictions if possible. Within 30 days: Monitor Nitro vendor advisories for patch release; evaluate alternative PDF readers with equivalent security posture and plan upgrade timeline once patch becomes available.

N A EUVD-2025-209417

| CVE-2025-69624 HIGH

NULL Pointer Dereference (CWE-476)

2026-04-13 mitre

GHSA-rrjx-h7jp-ggmg

Denial Of Service Null Pointer Dereference Microsoft N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:30 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.5 (None) 7.5 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 15:45 euvd

EUVD-2025-209417

Analysis Generated

Apr 13, 2026 - 15:45 vuln.today

CVE Published

Apr 13, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

Nitro PDF Pro for Windows 14.41.1.4 contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is called with more than one argument and the first argument evaluates to null (for example, app.alert(app.activeDocs, true) when app.activeDocs is null), the engine routes the call through a fallback path intended for non-string arguments. In this path, js_ValueToString() is invoked on the null value and returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation. Dereferencing this pointer leads to an access violation and application crash when opening a crafted PDF.

AnalysisAI

Nitro PDF Pro 14.41.1.4 for Windows crashes when processing maliciously crafted PDFs that invoke app.alert() with null arguments, causing denial of service through NULL pointer dereference in the JavaScript engine. Remote attackers can deliver weaponized PDF files requiring no authentication or user interaction beyond opening the document (AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.01% (2nd percentile), indicating low real-world targeting despite theoretical automation potential.

Technical ContextAI

This vulnerability affects the JavaScript engine embedded in Nitro PDF Pro, specifically the implementation of the Document Object Model (DOM) method app.alert(). The flaw occurs in a fallback code path designed to handle non-string arguments passed to app.alert(). When the first argument evaluates to null (such as app.activeDocs in a PDF without active documents), the engine invokes js_ValueToString() on the null value, which returns an invalid string pointer. This invalid pointer is subsequently passed to JS_GetStringChars() without null-check validation, triggering a NULL pointer dereference when the function attempts to access memory at address zero or an unmapped region. The vulnerability is classified as CWE-476 (NULL Pointer Dereference), a common software defect where code fails to validate pointer values before dereferencing them. PDF files can embed JavaScript that executes when the document is opened, making this a vector for automated denial-of-service attacks against users or systems processing untrusted PDFs.

RemediationAI

Organizations running Nitro PDF Pro 14.41.1.4 for Windows should immediately check for vendor security updates at http://nitro.com and apply the latest patched version when available. No vendor-released patch version has been independently confirmed from available data at time of analysis, so users should monitor the Nitro Software security advisory page for official remediation guidance. As an interim mitigation, organizations processing untrusted PDFs should implement sandboxing or isolation technologies to limit crash impact, disable JavaScript execution in PDF processing workflows if business requirements allow, or substitute alternative PDF readers that are not affected by this vulnerability for automated document processing pipelines. Email security gateways and document management systems should add behavioral detection rules to identify and quarantine PDFs containing suspicious app.alert() JavaScript invocations with null arguments. For interactive users, the primary mitigation is user awareness training to avoid opening PDFs from untrusted sources until patches are deployed.