CVE-2025-69627

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-69627", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-05T01:33:33.891Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-04-13T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T01:33:33.891Z"}, "descriptions": [{"lang": "en", "value": "Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://jeroscope.com/advisories/2025/jero-2025-016/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:39:52.327437Z", "id": "CVE-2025-69627", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T16:30:15.973Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-69627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T15:39:52.327437Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:40:19.774Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://jeroscope.com/advisories/2025/jero-2025-016/"}], "descriptions": [{"lang": "en", "value": "Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T01:33:33.891Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69627", "state": "PUBLISHED", "dateUpdated": "2026-07-05T01:33:33.891Z", "dateReserved": "2026-01-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-13T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gonitro:nitro_pdf_pro:14.41.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "F7223A11-A180-47D4-AD94-7C184636BDC3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes."}, {"lang": "es", "value": "Nitro PDF Pro para Windows 14.41.1.4 contiene una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n de pila en la implementaci\u00f3n del m\u00e9todo JavaScript this.mailDoc(). Durante la ejecuci\u00f3n, un objeto XID interno es asignado y luego liberado prematuramente, despu\u00e9s de lo cual el puntero liberado todav\u00eda se pasa a funciones auxiliares de interfaz de usuario y registro. Debido a que la regi\u00f3n de memoria liberada puede contener datos de pila impredecibles o restos de cadenas JavaScript controladas por el atacante, rutinas posteriores como wcscmp() pueden procesar punteros inv\u00e1lidos o obsoletos. Esto puede resultar en violaciones de acceso y fallos no deterministas."}], "id": "CVE-2025-69627", "lastModified": "2026-10-15T12:10:00.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69627", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:39:52.327437Z", "version": "2.0.3"}}]}, "published": "2026-04-13T16:16:24.867", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://jeroscope.com/advisories/2025/jero-2025-016/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "14.41.1.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "pdf_pro", "vendor": "nitro"}], "analysis": {"en": {"generated_at": "2026-04-14T20:50:07.178617+00:00", "value": {"mitigation_remediation": ["Check Nitro\u2019s website for the latest update and install the patch if available.", "Verify that your installed version is not 14.41.1.4.", "Avoid opening PDF files from untrusted or unknown sources until a patch is applied.", "Monitor crash logs for signs of exploitation attempts."], "summary": {"action": "Patch", "impact": "Denial of Service via application crash"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Nitro PDF Pro for Windows version\u202f14.41.1.4. No earlier or later versions are listed. Users running this exact build should consider the system at risk. No other products or platforms are noted in the advisory.", "description_and_impact": "Nitro PDF Pro for Windows contains a heap use\u2011after\u2011free bug in the JavaScript method this.mailDoc(). An XID object is created, freed prematurely, yet its pointer is still used in UI and logging functions. If the freed memory holds attacker\u2011controlled or corrupted data, operations such as string comparisons can dereference the stale pointer, leading to access violations and a crash. The primary consequence is a denial of service, as a maliciously crafted PDF can force the application to terminate unpredictably.", "risk_and_exploitability": "The CVSS score of 8.4 classifies the flaw as high severity. The EPSS score of less than 1% indicates the likelihood of exploitation remains low, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is a maliciously crafted PDF file that contains JavaScript targeting the this.mailDoc() method. An attacker would need a user to open the PDF, which could occur through phishing or social engineering. Until mitigated, the exposed system may experience spontaneous application crashes, potentially disrupting business processes."}}}}, "created": "2026-04-14T16:21:59.967317+00:00", "updated": "2026-04-15T15:45:07.540000+00:00", "vendors": ["nitro", "nitro$PRODUCT$pdf_pro"]}