Nitro PDF Pro for Windows contains a heap use‑after‑free bug in the JavaScript method this.mailDoc(). An XID object is created, freed prematurely, yet its pointer is still used in UI and logging functions. If the freed memory holds attacker‑controlled or corrupted data, operations such as string comparisons can dereference the stale pointer, leading to access violations and a crash. The primary consequence is a denial of service, as a maliciously crafted PDF can force the application to terminate unpredictably.

The vulnerability affects Nitro PDF Pro for Windows version 14.41.1.4. No earlier or later versions are listed. Users running this exact build should consider the system at risk. No other products or platforms are noted in the advisory.

The CVSS score of 8.4 classifies the flaw as high severity. The EPSS score of less than 1% indicates the likelihood of exploitation remains low, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector is a maliciously crafted PDF file that contains JavaScript targeting the this.mailDoc() method. An attacker would need a user to open the PDF, which could occur through phishing or social engineering. Until mitigated, the exposed system may experience spontaneous application crashes, potentially disrupting business processes.