CVE-2016-8709

CVE-2016-8709 (Nitro Pro) is a remote memory corruption flaw in Nitro Pro 10’s PDF parsing, caused by an out-of-bounds write in the npdf.dll path. Exploitation requires a crafted PDF file and can result in memory corruption or code execution, as detailed in Talos’ Nitro Pro PDF Handling Code Exec...

CVE-2016-8711

Nitro Pro 10 is affected by a remote code execution vulnerability in its PDF parsing functionality. The flaw is reported in the npdf.dll path (Nitro Pro’s PDF handling), where a crafted PDF can trigger code execution. Public writeups (Talos/Nitro) describe a memory-related condition inside CxImag...

CVE-2016-8713

CVE-2016-8713 corresponds to a memory-corruption vulnerability in Nitro Pro 10.5.9.9. Public analyses describe a remote or local memory corruption due to an out-of-bounds write in Nitro Pro’s PDF parsing path. The vulnerability centers on code in the npdf.dll module handling PDF content (e.g., op...

CVE-2025-67825

Nitro PDF Pro for Windows versions before 14.42.0.34 are vulnerable to an issue where the software displays signer information from a non-verified PDF field instead of the verified certificate subject. This inconsistency could lead to a document presenting forged or incorrect signer details. To r...

CVE-2025-69624

Nitro PDF Pro for Windows versions before 14.43 is vulnerable to a NULL pointer dereference within the JavaScript implementation of the app.alert() function. When the function is called with multiple arguments where the first argument is null (e.g., app.alert(app.activeDocs, true) when app.active...

CVE-2025-66769

A NULL pointer dereference vulnerability exists in Nitro PDF Pro for Windows v14.41.1.4 . This flaw allows an attacker to cause a Denial of Service (DoS) by providing a crafted XFA packet . No specific remediation or exploit details are provided in the documents.

CVE-2025-69627

Nitro PDF Pro for Windows version 14.41.1.4 is vulnerable to a heap use-after-free vulnerability within the this.mailDoc() JavaScript method. The issue occurs because an internal XID object is freed prematurely, yet its pointer is still accessed by UI and logging helper functions. This allows dow...