CVE-2025-66769
Published: 13 April 2026
Summary
CVE-2025-66769 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Gonitro Nitro Pdf Pro. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the NULL pointer dereference in Nitro PDF Pro, directly eliminating the vulnerability exploited by crafted XFA packets.
Error handling ensures the application gracefully manages NULL pointer dereferences and malformed XFA inputs without crashing and causing DoS.
Information input validation scrutinizes XFA packets for malformed content that could trigger the NULL pointer dereference leading to DoS.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL dereference in PDF XFA processing directly enables remote application crash for DoS via crafted input (T1499.004).
NVD Description
A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.
Deeper analysisAI
CVE-2025-66769 is a NULL pointer dereference vulnerability (CWE-476) in Nitro PDF Pro for Windows version 14.41.1.4. The issue enables attackers to trigger a Denial of Service (DoS) by processing a crafted XFA packet. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting high severity from its network vector, low complexity, no privilege or user interaction requirements, and significant availability impact without affecting confidentiality or integrity.
Remote attackers can exploit this vulnerability without authentication by delivering a malicious XFA packet to a victim using the affected software, such as via email attachments, web downloads, or shared files. Exploitation reliably crashes the Nitro PDF Pro application, denying service to the user until restart, though it does not enable code execution or data compromise.
Mitigation guidance is available in the Jeroscope advisory at https://jeroscope.com/advisories/2025/jero-2025-015/ and on the vendor site at https://www.gonitro.com/. Security practitioners should consult these for patching instructions and workarounds.
Details
- CWE(s)