CVE-2025-69627

HighCVSS 8.4/10Last modified Oct 15, 2026

Description

Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Apr 13, 2026
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-69639.8A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. This vulnerability affects unknown coCVE-2025-696339.8A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in versCVE-2025-696349.0Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field CVE-2025-696445.0An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary witCVE-2025-696455.5Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logicCVE-2025-696465.5Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logCVE-2025-696476.2GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists dCVE-2025-696486.2GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rngCVE-2025-696497.5GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header CVE-2025-69657.7There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns availabCVE-2025-696507.5GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. DurCVE-2025-696515.5GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malf
CVE-2025-69627: High severity, CVSS 8.4 | Vulnix