{"uuid": "83b5ba28-c217-4a6e-8aac-07e2cdb0bcf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-45528", "type": "seen", "source": "https://gist.github.com/momenbasel/66e33613a52f6f59e49ee8ca6ea91a61", "content": "# CVE-2025-45528: Arbitrary Code Execution in Nitro PDF Pro for macOS 14.7\n\n- **CVE ID:** CVE-2025-45528\n- **Status:** RESERVED (assigned by MITRE 2025-06-17, Service Request 1843838)\n- **Affected product:** Nitro PDF Pro for macOS, version 14.7\n- **Vendor:** Nitro Software, Inc. \u2014 https://www.gonitro.com/\n- **Vulnerability class:** Arbitrary code execution via crafted file (CWE-94)\n- **Attack vector:** Local \u2014 requires the victim to open a crafted PDF\n- **Reporter:** Mo'men Basel\n\n## Summary\n\nNitro PDF Pro for macOS v14.7 allows a local attacker to execute arbitrary code\nvia a crafted PDF.\n\nThis is the description MITRE assigned CVE-2025-45528 to, verbatim, on\n17 June 2025:\n\n> An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local\n> attacker to execute arbitrary code via a crafted PDF\n\n## Impact\n\nCode execution in the context of the user who opens the document. PDFs are\nroutinely received by email and from untrusted sources, and Nitro PDF Pro is\nfrequently configured as the default handler for the file type on macOS, so the\nrequired user interaction is a low barrier.\n\n## Affected versions\n\nConfirmed on Nitro PDF Pro for macOS 14.7. Later versions have not been assessed\nby the reporter.\n\n## Vendor status\n\nNo advisory for this issue was published by Nitro Software at the time of\nwriting, and the CVE record has remained unpublished since assignment.\n\nNitro Software's security team was contacted at `security@gonitro.com` on\n2026-08-27 with the details and a request for a vendor advisory so this record\ncan be published. This document exists to provide the public reference MITRE\nrequires before a reserved CVE can move to published.\n\n## Timeline\n\n| Date | Event |\n|---|---|\n| 2025-03-28 | Reported to MITRE (Service Request 1843838) |\n| 2025-06-17 | CVE-2025-45528 assigned; record held reserved |\n| 2026-08-27 | Confirmed absent from the CVE List and NVD |\n| 2026-08-27 | Vendor contacted at security@gonitro.com |\n| 2026-08-27 | This advisory published as the public reference |\n\n## Verification of unpublished status\n\nQueried on 2026-08-27:\n\n```\n$ curl -s https://cveawg.mitre.org/api/cve/CVE-2025-45528\n{\"error\":\"CVE_RECORD_DNE\",\"message\":\"The cve record for the cve id does not exist.\"}\n```\n\nThe ID is also absent from the NVD API.\n\n## Credit\n\nMo'men Basel\n", "creation_timestamp": "2026-08-27T12:35:24.351421Z"}