Quick answers
- Is CVE-2025-69624 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-69624 being exploited in the wild.
- How severe is CVE-2025-69624?
- High severity, with a CVSS score of 7.5, published 13 April 2026.
- Which products and versions are affected?
- Nitro PDF Pro Before 14.43.
- Is there a fix for CVE-2025-69624?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-69624 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-69624?
- Check whether you run Gonitro Nitro Pdf Pro, Microsoft Windows or Nitro PDF Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in the JavaScript implementation of the 'app.alert()' function in Nitro PDF Pro before version 14.43. When 'app.alert()' is called with multiple arguments and the first argument evaluates to null, the engine incorrectly routes the call through a fallback path for non-string arguments. Within this path, 'js_ValueToString()' is called on the null value, returning an invalid string pointer that is subsequently passed to 'JS_GetStringChars()' without validation. This results in an access violation and application crash. The vulnerability can be exploited by an unauthenticated attacker via a crafted PDF file. A fix is available in version 14.43 and later.
Affected products
- Nitro Nitro PDF Pro Before 14.43
Timeline
- 2026-04-13: advisory: Initial NVD publication
- 2026-07-05: other: Advisory updated with specific version details and references