MUHAMMARA · CVE-2026-125107 · Package
FIX → 6.0.5
Muhammara's PDF parser dereferences a null pointer when an LZWDecode stream's DecodeParms lacks the EarlyChange key. An attacker who supplies a crafted PDF can crash any process that reads stream contents with it, causing denial of service.
first public Jun 26, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that accept untrusted PDF files and use muhammara to read stream contents are exposed to a crash. Projects that only generate PDFs or never process uploaded PDFs are unlikely to be reached by this flaw.
Not affected if managed-hosting, no-untrusted-pdfs
Who cares muhammara, npm, pdf
muhammara in package.json or the lockfile, and note the installed version.Upgrade to 6.0.5
muhammara 6.0.56.0.4 are affected.A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.
muhammara <= 6.0.4 (latest)
File: src/deps/PDFWriter/PDFParser.cpp line 2107
if (inDecodeParams)
{
PDFObjectCastPtr<PDFInteger> earlyObj(
QueryDictionaryObject(inDecodeParams, "EarlyChange")
);
early = earlyObj->GetValue(); // NULL dereference when EarlyChange key is absent
}
When inDecodeParams is non-NULL but lacks the EarlyChange key:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
QueryDictionaryObject() returns NULLPDFObjectCastPtr<PDFInteger>(NULL) wraps NULLearlyObj->GetValue() dereferences NULL → crash460-byte malicious PDF triggers crash via startReadingFromStream():
/Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)0xC0000005 (Access Violation)if (earlyObj)
early = earlyObj->GetValue();
Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.
Similar to: CVE-2022-41957, CVE-2022-39381
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.