Nitro PDF Pro vulnerabilities

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF. The vulnerability requires a user to open a malicious document on the targeted system.

Nitro PDF Pro for Windows version 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. This can result in access violations and non-deterministic crashes.

The vulnerability in Nitro PDF Pro for Windows before version 14.43 is a NULL pointer dereference in the JavaScript implementation of the app.alert() function. Calling app.alert() with more than one argument where the first argument evaluates to null (e.g., app.alert(app.activeDocs, true) when app.activeDocs is null) causes the engine to route through a fallback path for non-string arguments. In this path, js_ValueToString() returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation, leading to an access violation and application crash when opening a crafted PDF.