The vulnerability is a NULL pointer dereference within the JavaScript engine of Nitro PDF Pro for Windows. When app.alert() receives a null value as its first argument, the code incorrectly processes it, leading the engine to call js_ValueToString() on a null reference. The resulting invalid string pointer is then passed to JS_GetStringChars() without validation, causing an access violation that terminates the application. This crash results in a denial of service that can be triggered by a specially crafted PDF file. The weakness is CWE‑476 and results in a local application failure.

Nitro PDF Pro for Windows, version 14.41.1.4 is affected. Users of this version are vulnerable when they open a malicious PDF that exploits the faulty app.alert() routine. No other products or versions are mentioned in the advisory.

The CVSS base score of 7.5 indicates a high impact vulnerability that can be abused without authentication. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, implying it may not yet be actively exploited. The most likely attack vector is local file execution; an attacker can craft a PDF that triggers the crash when opened by a user. Mitigation requires applying a vendor update or restricting access to untrusted PDFs until a patch is available.