CVE-2025-69624

OVERVIEW Nitro PDF Pro for Windows version 14.41.1.4 contains a NULL pointer dereference vulnerability in its JavaScript implementation. Specifically, the app.alert() function fails to properly validate string pointers when called with multiple arguments where the first argument is null, such as app.alert(app.activeDocs, true) when app.activeDocs returns null. This vulnerability can be triggered by opening a specially crafted PDF file. SEVERITY The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector, low attack complexity, requiring no user privileges or interaction beyond opening a malicious PDF. The attack causes a denial of service through application crash due to access violations when dereferencing an invalid pointer. No confidentiality or integrity impact is expected, as the vulnerability only affects availability. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog and is not listed on active exploit hot lists. The extremely low EPSS score of 0.00017 indicates minimal real-world exploitation probability. No public exploit code is currently documented, and community attention remains minimal, though the moderate FAUCET Risk Score of 48.0 suggests some concern among security researchers monitoring the application.