CVE-2025-69624: n/a
Nitro PDF Pro for Windows version 14. 41. 1. 4 contains a NULL pointer dereference vulnerability in its JavaScript app. alert() implementation. When app. alert() is called with multiple arguments and the first argument evaluates to null, the application dereferences an invalid string pointer, causing an access violation and crash. This occurs when opening a specially crafted PDF file. No patch or official remediation guidance is currently available. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
CVE-2025-69624 is a NULL pointer dereference vulnerability in Nitro PDF Pro for Windows 14.41.1.4. The issue arises in the JavaScript engine's handling of the app.alert() function when called with more than one argument and the first argument is null. The fallback code path improperly converts the null value to a string pointer without validation, leading to an invalid pointer dereference and application crash upon processing crafted PDF files.
Potential Impact
Successful exploitation causes an application crash (denial of service) when opening a maliciously crafted PDF document. There is no indication of code execution or data corruption beyond the crash. No known exploits have been reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening untrusted PDF files with Nitro PDF Pro 14.41.1.4 to avoid triggering the crash.
CVE-2025-69624: n/a
Description
Nitro PDF Pro for Windows version 14. 41. 1. 4 contains a NULL pointer dereference vulnerability in its JavaScript app. alert() implementation. When app. alert() is called with multiple arguments and the first argument evaluates to null, the application dereferences an invalid string pointer, causing an access violation and crash. This occurs when opening a specially crafted PDF file. No patch or official remediation guidance is currently available. There are no known exploits in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-69624 is a NULL pointer dereference vulnerability in Nitro PDF Pro for Windows 14.41.1.4. The issue arises in the JavaScript engine's handling of the app.alert() function when called with more than one argument and the first argument is null. The fallback code path improperly converts the null value to a string pointer without validation, leading to an invalid pointer dereference and application crash upon processing crafted PDF files.
Potential Impact
Successful exploitation causes an application crash (denial of service) when opening a maliciously crafted PDF document. There is no indication of code execution or data corruption beyond the crash. No known exploits have been reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening untrusted PDF files with Nitro PDF Pro 14.41.1.4 to avoid triggering the crash.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-01-09T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dd0c8782d89c981f09c94d
Added to database: 4/13/2026, 3:32:23 PM
Last enriched: 4/13/2026, 3:47:06 PM
Last updated: 4/13/2026, 5:15:50 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.