The vulnerability is a NULL pointer dereference, CWE‑476, in Nitro PDF Pro’s JavaScript engine for Windows. It occurs when app.alert() is invoked with more than one argument and the first argument evaluates to null (for example, app.alert(app.activeDocs, true) when app.activeDocs is null). The engine routes the call through a fallback path intended for non‑string arguments; js_ValueToString() is invoked on the null value and returns an invalid string pointer, which is then passed to JS_GetStringChars() without validation. Dereferencing this pointer leads to an access violation and application crash when opening a crafted PDF. Attackers can embed this call in a malicious PDF to trigger denial‑of‑service.

Nitro PDF Pro for Windows, versions 14.41.1.4 and 14.42.0.34 are affected. Users of these versions are vulnerable when they open a malicious PDF that exploits the faulty app.alert() routine. Any build before 14.43 is also potentially vulnerable.

The CVSS base score of 7.5 indicates a high impact vulnerability. The EPSS score of < 1% indicates a very low exploitation probability. The issue is not listed in the CISA KEV catalog, implying it may not yet be actively exploited. The most likely attack vector is local file execution; an attacker can craft a PDF that triggers denial‑of‑service. Mitigation requires applying a vendor update or restricting access to untrusted PDFs until a patch is available.