Executive brief
Nitro PDF Pro, a popular application for creating and editing PDF documents, is vulnerable to a memory handling error when processing specific JavaScript commands. An attacker could exploit this by tricking a user into opening a specially crafted PDF file, which could lead to application crashes or potentially allow for unauthorized code execution. This vulnerability poses a risk to the stability of the software and the security of the system it is running on.
Technical details
A heap use-after-free vulnerability exists in Nitro PDF Pro 14.41.1.4 within the 'this.mailDoc()' JavaScript method implementation. The vulnerability is triggered when an internal XID object is allocated and then prematurely freed via 'j_j_free_0', yet the pointer remains in use by downstream routines such as 'CDumpContext::operator<<' and 'wcscmp()'. An attacker can trigger this condition by embedding a call to 'this.mailDoc()' in a malicious PDF document. Depending on the heap state, this leads to access violations, non-deterministic crashes, or potential exploitation if the freed memory is reclaimed by attacker-controlled data. A patch was released by the vendor in February 2026.
Affected products
- Nitro Nitro PDF Pro 14.41.1.4
Timeline
- 2025-12-10: disclosed: Vulnerability reported to vendor
- 2026-02-02: patched: Vendor patch release
- 2026-04-13: advisory: NVD publication date