CVE-2025-67825: 
Nitro Pro vulnerability analysis and mitigation

CVE-2025-67825 is an origin validation error in Nitro PDF Pro for Windows that causes the application to display signer information sourced from a non-verified PDF field rather than from the verified certificate subject, enabling crafted documents to present misleading signer details. It affects all versions of Nitro PDF Pro for Windows before 14.42.0.34. The CVE was published on January 8, 2026, and received a CVSS v3.1 base score of 5.5 (Medium), assessed by CISA-ADP (Red Hat CVE, Nitro Release Notes).

The root cause is classified as CWE-346 (Origin Validation Error): Nitro PDF Pro's display logic fails to consistently validate the source of signer information, pulling it from an unverified PDF metadata field instead of the authenticated certificate subject. An attacker can craft a PDF document that embeds arbitrary signer details in the unverified field, which the application then renders as if it were the verified identity. Exploitation requires local access and user interaction — specifically, a victim must open the malicious PDF in a vulnerable version of Nitro PDF Pro. No public proof-of-concept code has been identified (Red Hat CVE, Nitro Release Notes).

Successful exploitation allows an attacker to deceive users into believing a PDF document was signed by a trusted or authoritative entity when it was not, undermining the integrity of digital signature verification. This primarily affects document integrity (high integrity impact) with no direct confidentiality or availability consequences. The practical risk lies in social engineering scenarios where users or automated workflows trust displayed signer information to make decisions about document authenticity, potentially leading to acceptance of forged or tampered documents (Red Hat CVE).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2025-67825. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a victim to open a specially crafted PDF, limiting the attack surface to social engineering delivery vectors (Red Hat CVE).

1. Craft a malicious PDF: Create a PDF document that contains a digitally signed section with a legitimate certificate, but embed a separate, attacker-controlled signer name or organization in an unverified PDF metadata or form field.
2. Deliver the document: Send the crafted PDF to a target via email, file share, or other social engineering channel, presenting it as a trusted document (e.g., a contract or official communication).
3. Victim opens the PDF: The target opens the document in a vulnerable version of Nitro PDF Pro (before 14.42.0.34).
4. Misleading signer displayed: Nitro PDF Pro displays the attacker-controlled signer information from the unverified field rather than the actual verified certificate subject, causing the victim to believe the document was signed by a trusted party.
5. Social engineering objective achieved: The victim acts on the false signer information — approving, forwarding, or executing the document — under the mistaken belief it is authentic (Red Hat CVE, Nitro Release Notes).

Upgrade Nitro PDF Pro for Windows to version 14.42.0.34 or later, which updates the display logic to ensure signer information consistently reflects the verified certificate identity. No configuration-based workaround has been published; patching is the only confirmed remediation. Organizations relying on digital document authentication should prioritize this update and train users to verify document signatures through advanced verification features rather than relying solely on the displayed signer name (Nitro Release Notes, Red Hat CVE).

The vulnerability received brief coverage from security news aggregators including TheHackerWire on Mastodon and Bluesky shortly after disclosure. No significant vendor statements beyond the Nitro release notes or notable independent researcher commentary have been identified. Community reaction has been minimal, consistent with the medium severity rating and absence of active exploitation.