CVE-2025-69624: 
Nitro Pro vulnerability analysis and mitigation

CVE-2025-69624 is a NULL pointer dereference vulnerability in Nitro PDF Pro for Windows version 14.41.1.4, specifically within the JavaScript implementation of the app.alert() function. When app.alert() is invoked with more than one argument and the first argument evaluates to null, the application crashes due to an access violation, resulting in a denial of service. The vulnerability was published on April 13, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is a NULL pointer dereference (CWE-476) in Nitro PDF Pro's JavaScript engine. When app.alert() is called with multiple arguments and the first evaluates to null (e.g., app.alert(app.activeDocs, true) when app.activeDocs is null), the engine routes execution through a fallback path for non-string arguments. In this path, js_ValueToString() is called on the null value and returns an invalid string pointer, which is subsequently passed to JS_GetStringChars() without any null-check validation. Dereferencing this invalid pointer triggers an access violation and crashes the application when a specially crafted PDF is opened (GitHub Advisory).

Successful exploitation results in an application crash (denial of service), with no impact on confidentiality or integrity. An attacker can craft a malicious PDF embedding JavaScript that calls app.alert() with a null first argument, causing Nitro PDF Pro to crash whenever the file is opened by a victim. The impact is limited to availability of the affected application; there is no evidence of code execution or data exfiltration potential from this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Craft a malicious PDF: Create a PDF document containing embedded JavaScript that calls app.alert() with a null-evaluating first argument, such as app.alert(app.activeDocs, true) when app.activeDocs is null.
2. Distribute the PDF: Deliver the crafted PDF to a target user via email, file sharing, or a malicious website — no authentication or special privileges are required on the attacker's side.
3. Victim opens the PDF: When the target opens the malicious PDF in Nitro PDF Pro 14.41.1.4, the JavaScript engine executes the embedded script.
4. Trigger the crash: The app.alert() call routes through the non-string fallback path; js_ValueToString() returns an invalid pointer that is passed unvalidated to JS_GetStringChars(), causing a NULL pointer dereference, access violation, and application crash — achieving denial of service (GitHub Advisory).

• File System: Presence of unexpected or unsolicited PDF files containing embedded JavaScript, particularly those invoking app.alert() with multiple arguments.
• Logs: Application crash logs or Windows Event Viewer entries (Event ID 1000) referencing NitroPDF.exe or related Nitro PDF Pro processes with access violation fault codes.
• Process: Unexpected termination of the Nitro PDF Pro process (NitroPDF.exe) shortly after opening a PDF file, potentially accompanied by Windows Error Reporting (WER) crash dumps in %LOCALAPPDATA%\CrashDumps.

Users should update Nitro PDF Pro for Windows to a version newer than 14.41.1.4 as soon as a patched release becomes available from the vendor. In the interim, avoid opening PDF files from untrusted or unknown sources. Additional mitigations include disabling JavaScript execution in PDF readers where possible, implementing application sandboxing, and monitoring vendor communications at nitro.com for security updates (GitHub Advisory).

A brief mention of the vulnerability appeared on Mastodon via @thehackerwire shortly after disclosure. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond standard vulnerability database entries.