Executive brief
Nitro PDF Pro is a popular application used for creating, editing, and signing PDF documents. A vulnerability in how the software handles specific PDF form data (XFA) allows an attacker to crash the application by providing a specially crafted file. If a user opens such a file, the program will terminate immediately, potentially leading to data loss or disruption of operations.
Technical details
A NULL pointer dereference exists in Nitro PDF Pro 14.41.1.4 during the processing of XML Forms Architecture (XFA) data. When a PDF contains an empty /XFA array within the /AcroForm dictionary, the application's XFA processing routine attempts to locate root nodes (such as 'xdp:xdp' or 'template'). Because the structure is empty, the lookup function returns a NULL pointer, which is subsequently dereferenced by the next operation without validation. An attacker can trigger this crash by convincing a user to open a maliciously crafted PDF file. The vendor released a patch for this issue on January 9, 2026.
Affected products
- Nitro Nitro PDF Pro 14.41.1.4
Timeline
- 2025-11-19: disclosed: Vulnerability reported to vendor
- 2026-01-09: patched: Vendor patch release
- 2026-04-06: advisory: Public release of advisory
- 2026-04-13: other: CVE published