CVE-2025-66769: 
Nitro Pro vulnerability analysis and mitigation

CVE-2025-66769 is a NULL pointer dereference vulnerability in Nitro PDF Pro for Windows version 14.41.1.4 that allows attackers to cause a Denial of Service (DoS) by sending a crafted XFA packet. It was published on April 13, 2026, and is classified under CWE-476. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting its network-exploitable, unauthenticated nature with high availability impact (GitHub Advisory).

The vulnerability is rooted in improper handling of XFA (XML Forms Architecture) packet data within Nitro PDF Pro, classified as CWE-476 (NULL Pointer Dereference). When the application processes a specially crafted XFA packet, it dereferences a pointer expected to be valid but is NULL, causing an application crash. Exploitation requires no authentication, no user interaction, and can be triggered remotely over a network, making the attack surface broad. The original security advisory is documented at jeroscope.com (GitHub Advisory).

Successful exploitation causes Nitro PDF Pro to crash, resulting in a Denial of Service that disrupts PDF processing operations and renders the application unavailable to users. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Organizations relying on Nitro PDF Pro for document workflows could experience service interruptions if targeted with malicious PDF files containing crafted XFA packets (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed (GitHub Advisory). The EPSS score is approximately 0.013% (0.002% per GitHub Advisory), placing it in the lowest percentile for near-term exploitation likelihood. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Users should update Nitro PDF Pro for Windows to a version beyond 14.41.1.4 that includes the security fix, as a patch has been confirmed available (GitHub Advisory). Until patching is feasible, organizations should restrict Nitro PDF Pro to processing only trusted documents and implement email filtering to block potentially malicious PDF files from reaching end users. Monitoring for unexpected application crashes in Nitro PDF Pro may help detect exploitation attempts.

The vulnerability received limited public attention, with mentions appearing on aggregator platforms such as VulDB, CVEfeed.io, and cve.report shortly after disclosure. A brief note was shared on Mastodon via @thehackerwire. No significant vendor statements beyond the original advisory or notable researcher commentary have been identified.