Description
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
Published: 2026-10-23
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Code Execution
Action: Assess
AI Analysis

Impact

Nitro PDF Pro for macOS 14.7 contains a code execution vulnerability (CWE‑94) that allows a local attacker to run arbitrary code through a crafted PDF. When an authorized user opens such a PDF, the parser mistakenly treats malicious content as executable instructions, enabling the attacker to execute commands with the user’s privileges. This flaw can expose the host to full system compromise, including data theft, modification, and service disruption.

Affected Systems

The issue impacts Nitro Software, Inc Nitro PDF Pro for macOS version 14.7. Systems running that exact version on macOS are susceptible. No other versions or operating systems were specifically identified.

Risk and Exploitability

The CVSS score is 7.3, the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local, requiring the attacker to supply a malicious PDF file and have it opened on the victim’s machine. Exploitation would be straightforward for a local user or someone who gains temporary file access.

Generated by OpenCVE AI on October 29, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Nitro PDF Pro to the latest version released by Nitro Software, Inc, which removes the parsing flaw that enables arbitrary code execution.
  • If an update is not available, avoid opening PDFs from untrusted sources and consider disabling the PDF viewer feature or uninstalling the application until a fix is issued.
  • Consider migrating to a different PDF reader that does not rely on Nitro PDF Pro’s vulnerable component, or isolate the application via sandboxing or containerization to limit the damage of any potential exploitation.

Generated by OpenCVE AI on October 29, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Title Local Code Execution via Malicious PDF in Nitro PDF Pro 14.7

Thu, 29 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Title Local Code Execution via Crafted PDF in Nitro PDF Pro 14.7 for macOS
Weaknesses CWE-20

Thu, 29 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Gonitro
Gonitro nitro Pdf Pro
Vendors & Products Gonitro
Gonitro nitro Pdf Pro

Fri, 23 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Title Local Code Execution via Crafted PDF in Nitro PDF Pro 14.7 for macOS
Weaknesses CWE-20

Fri, 23 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
References

Subscriptions

Gonitro Nitro Pdf Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-29T02:43:32.846Z

Reserved: 2025-04-22T00:00:00.000Z

Link: CVE-2025-45528

cve-icon Vulnrichment

Updated: 2026-10-29T02:43:27.729Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-23T16:16:50.607

Modified: 2026-10-29T04:18:21.067

Link: CVE-2025-45528

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T06:30:12Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')