A NULL pointer dereference vulnerability in Nitro PDF Pro for Windows allows an unauthenticated attacker to trigger a denial of service via a maliciously crafted PDF file.

The vulnerability exists in the JavaScript implementation of the app.alert() function, where improper validation of null arguments leads to an access violation when processing non-string inputs. An unauthenticated attacker can trigger this condition by providing a specially crafted PDF document.

The primary risk associated with this vulnerability is a denial of service, as the application will crash upon processing the malicious file. While this does not lead to remote code execution, it disrupts business operations and productivity by rendering the PDF software unusable for the affected user. The CVSS score of 7.5 reflects the high impact on system availability and the ease of exploitation.

Immediate Action: Users should update to Nitro PDF Pro version 14.43 or later as soon as the vendor provides the update. If an update is not yet available, verify your current version and exercise caution when opening untrusted PDF documents.

Proactive Monitoring: Security teams should monitor system logs for frequent application crashes or unexpected terminations of the Nitro PDF process.

Compensating Controls: Deploy endpoint security solutions that can detect and block the execution of malformed PDF documents containing suspicious JavaScript patterns.

Public Exploit Available: No (exploit_available: false)

Given the potential for service disruption, administrators should prioritize the deployment of the vendor-supplied fix as soon as it is released. Until the patch is applied, users should be advised to avoid opening PDF files from untrusted or unknown sources to mitigate the risk of application crashes.