Gonitro vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-69627 Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc().High 8.4 · Apr 13, 2026
• CVE-2025-69624 Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert().High 7.5 · Apr 13, 2026
• CVE-2025-66769 A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.High 7.5 · Apr 13, 2026
• CVE-2024-35288 Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repairHigh 7.8 · Oct 9, 2024
• CVE-2021-21797 An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.High 7.8 · Oct 18, 2021
• CVE-2021-21796 An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.High 7.8 · Oct 18, 2021
• CVE-2021-21798 An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.High 7.8 · Sep 15, 2021
• CVE-2020-6116 An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242.High 7.8 · Sep 17, 2020
• CVE-2020-6115 An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242.High 7.8 · Sep 17, 2020
• CVE-2020-6113 An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-referenceHigh 7.8 · Sep 17, 2020
• CVE-2020-6112 An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when decoding sHigh 7.8 · Sep 17, 2020
• CVE-2020-6146 An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300.High 8.8 · Sep 16, 2020
• CVE-2020-6092 An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects.High 7.8 · May 18, 2020
• CVE-2020-6074 An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155.High 8.8 · May 18, 2020
• CVE-2020-10223 npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to JBIG2Decode CNxJBIG2DecodeStream Heap Corruption at npdf!CAPPDAnnotHandlerUtils::create_popup_for_markHigh 8.1 · Mar 8, 2020
• CVE-2020-10222 npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to Heap Corruption at npdf!nitro::get_property+2381 via a crafted PDF document.High 8.1 · Mar 8, 2020
• CVE-2013-2773 Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code ExecutionHigh 7.8 · Jan 14, 2020
• CVE-2019-18958 Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG High 7.8 · Nov 21, 2019
• CVE-2019-5053 An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF.High 7.8 · Oct 9, 2019
• CVE-2019-5050 A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522.High 7.8 · Oct 9, 2019
• CVE-2019-5048 A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522.High 7.8 · Oct 9, 2019
• CVE-2019-5047 An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF.High 7.8 · Oct 9, 2019
• CVE-2019-5046 A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522.High 7.8 · Oct 9, 2019
• CVE-2019-5045 A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522.High 7.8 · Oct 9, 2019
• CVE-2017-7442 Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.High 8.8 · Aug 3, 2017