CVE-2025-69627: Use After Free
Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69627?
CVE-2025-69627 has a medium severity rating due to its heap use-after-free vulnerability potentially leading to application crashes or arbitrary code execution.
How do I fix CVE-2025-69627?
To fix CVE-2025-69627, update Nitro PDF Pro for Windows to the latest version released by Nitro Software.
What versions of Nitro PDF Pro are affected by CVE-2025-69627?
CVE-2025-69627 affects Nitro PDF Pro for Windows version 14.41.1.4.
What type of vulnerability is CVE-2025-69627?
CVE-2025-69627 is categorized as a heap use-after-free vulnerability related to the JavaScript method this.mailDoc().
Can CVE-2025-69627 be exploited remotely?
Yes, CVE-2025-69627 can potentially be exploited remotely if an attacker can manipulate the JavaScript execution context within Nitro PDF Pro.