Quick answers
- Is CVE-2025-66769 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-66769 being exploited in the wild.
- How severe is CVE-2025-66769?
- High severity, with a CVSS score of 7.5, published 13 April 2026.
- Which products and versions are affected?
- Nitro Nitro PDF Pro 14.41.1.4.
- Is there a fix for CVE-2025-66769?
- A patch was published on 2026-01-09: Vendor patch release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-66769 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-66769?
- Check whether you run Gonitro Nitro Pdf Pro or Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in Nitro PDF Pro 14.41.1.4 during the processing of XML Forms Architecture (XFA) data. When a PDF contains an empty /XFA array within the /AcroForm dictionary, the application's XFA processing routine attempts to locate root nodes (such as 'xdp:xdp' or 'template'). Because the structure is empty, the lookup function returns a NULL pointer, which is subsequently dereferenced by the next operation without validation. An attacker can trigger this crash by convincing a user to open a maliciously crafted PDF file. The vendor released a patch for this issue on January 9, 2026.
Affected products
- Nitro Nitro PDF Pro 14.41.1.4
Timeline
- 2025-11-19: disclosed: Vulnerability reported to vendor
- 2026-01-09: patched: Vendor patch release
- 2026-04-06: advisory: Public release of advisory
- 2026-04-13: other: CVE published