CVE-2025-45528
UnknownSummary
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF. The vulnerability requires a user to open a malicious document on the targeted system.
Risk Assessment
A local attacker can execute arbitrary code with the privileges of the user opening the malicious PDF, potentially compromising the account or data. The risk affects workstations with the vulnerable software installed.
Recommendation
Update Nitro PDF Pro for macOS to a version containing the fix and exercise caution when opening PDFs from untrusted sources. Consider limiting privileges of users who open documents.
Other vulnerabilities in Nitro PDF Pro
See all- CVE-2025-69627High
Nitro PDF Pro for Windows version 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. This can result in access violations and non-deterministic crashes.
- CVE-2025-69624High
The vulnerability in Nitro PDF Pro for Windows before version 14.43 is a NULL pointer dereference in the JavaScript implementation of the app.alert() function. Calling app.alert() with more than one argument where the first argument evaluates to null (e.g., app.alert(app.activeDocs, true) when app.activeDocs is null) causes the engine to route through a fallback path for non-string arguments. In this path, js_ValueToString() returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation, leading to an access violation and application crash when opening a crafted PDF.
Original NVD description (English source)
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
Vulnerability data from NVD (NIST) · CISA KEV · EPSS