CVE-2025-69627

OVERVIEW CVE-2025-69627 is a heap use-after-free vulnerability affecting Nitro PDF Pro for Windows version 14.41.1.4. The flaw exists in the JavaScript implementation of the mailDoc() method, where an internal XID object is prematurely freed but subsequently passed to UI and logging helper functions, potentially exposing freed memory containing unpredictable heap data or attacker-controlled strings. SEVERITY This vulnerability carries a CVSS score of 8.4 (High) with a local attack vector requiring no user interaction or privileges. The low complexity of exploitation combined with high potential impact across confidentiality, integrity, and availability makes this a significant risk. Exploitation can result in access violations and non-deterministic crashes through invalid or stale pointer processing in downstream functions such as wcscmp(). EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and no publicly available exploit code has been reported. Community attention remains minimal, with an EPSS score of 0.000070 indicating extremely low probability of exploitation compared to the broader CVE population. Organizations should nevertheless prioritize patching given the severity rating and the potential for weaponization.