ZeroDay Findings
Sign inSign up

Findings

CVE-2025-69627

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc().

Published Apr 13, 2026 · updated Oct 15, 2026 · gonitro nitro pdf pro

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 13, 2026 · NIST NVD

    Detected

    Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacke

  2. Oct 15, 2026 · NIST NVD

    Updated

    Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacke

Affected

  • cpe gonitro/nitro pdf pro14.41.1.4

Sources

  • CVE.orgVulnerability recordCVE-2025-69627

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-69627

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2025-69627

    Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI

    nvd.nist.gov

References