{"id":"CVE-2026-125107","kind":"vulnerability","aliases":["CVE-2026-125107","GHSA-fhp4-pr5j-46m5"],"related":[],"title":"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key","description":"## Summary\n\nA NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process.\n\n## Affected Version\n\nmuhammara <= 6.0.4 (latest)\n\n## Vulnerability Details\n\n**File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107\n\n```cpp\nif (inDecodeParams)\n{\n    PDFObjectCastPtr<PDFInteger> earlyObj(\n        QueryDictionaryObject(inDecodeParams, \"EarlyChange\")\n    );\n    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent\n}\n```\n\nWhen `inDecodeParams` is non-NULL but lacks the `EarlyChange` key:\n1. `QueryDictionaryObject()` returns NULL\n2. `PDFObjectCastPtr<PDFInteger>(NULL)` wraps NULL\n3. `earlyObj->GetValue()` dereferences NULL → crash\n\n## PoC\n\n460-byte malicious PDF triggers crash via `startReadingFromStream()`:\n\n- PDF contains `/Filter /LZWDecode` with `/DecodeParms << >>` (empty, no EarlyChange)\n- Exit code: `0xC0000005` (Access Violation)\n\n## Fix\n\n```cpp\nif (earlyObj)\n    early = earlyObj->GetValue();\n```\n\n## Impact\n\nAny application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.\n\nSimilar to: CVE-2022-41957, CVE-2022-39381\n\n## PoC File\n[poc_muhammara_lzw_null.js](https://github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)","summary":"Muhammara's PDF parser dereferences a null pointer when an LZWDecode stream's DecodeParms lacks the EarlyChange key. An attacker who supplies a crafted PDF can crash any process that reads stream contents with it, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"muhammara","fixed":["6.0.5"],"affected":"<= 6.0.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-476","muhammara","npm","package","pdf"],"not_affected_if":["managed-hosting","no-untrusted-pdfs"],"how_to_check":"- Check whether the project depends on `muhammara` in `package.json` or the lockfile, and note the installed version.\n- Confirm whether the application parses untrusted PDFs with muhammara's stream-reading functions.","fix":"- `muhammara` `6.0.5`\n- Versions up to and including `6.0.4` are affected.","status":"open","published_at":"2026-06-26T20:55:18+00:00","first_seen_at":"2026-11-09T21:29:57+00:00","triaged_at":"2026-11-09T21:31:18+00:00","updated_at":"2026-11-09T21:31:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T21:31:18Z","model":"claude-haiku-5-5","output":{"fix":"- `muhammara` `6.0.5`\n- Versions up to and including `6.0.4` are affected.","reach":"internet","title":"Muhammara: malformed PDF stream crashes PDF parsing with a null pointer","impact":"low","summary":"Muhammara's PDF parser dereferences a null pointer when an LZWDecode stream's DecodeParms lacks the EarlyChange key. An attacker who supplies a crafted PDF can crash any process that reads stream contents with it, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","muhammara","pdf"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Process crashes when a crafted PDF is parsed, causing denial of service","analyst_note":"","how_to_check":"- Check whether the project depends on `muhammara` in `package.json` or the lockfile, and note the installed version.\n- Confirm whether the application parses untrusted PDFs with muhammara's stream-reading functions.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-pdfs","managed-hosting"],"who_is_affected":"Applications that accept untrusted PDF files and use muhammara to read stream contents are exposed to a crash. Projects that only generate PDFs or never process uploaded PDFs are unlikely to be reached by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000794,"input_tokens":5234,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125107':17A,25A '-2022':216C,219C '-2026':16A,24A '-39381':220C '-41957':217C '-476':28B '/decodeparms':92C,180C '/filter':88C,177C '/lzwdecode':89C,178C '/user-attachments/files/27186113/poc_muhammara_lzw_null.js)':226C '0xc0000005':106C,186C '1':151C '2':155C '2107':121C '3':160C '460':167C '46m5':22A '6.0.4':114C 'absent':139C 'accept':199C 'access':104C,187C 'affect':111C 'applic':198C 'attack':52B 'byte':168C 'caus':68B,102C 'code':185C 'contain':97C,176C 'content':65B,208C 'cpp':122C,190C 'craft':56B 'crash':59B,108C,165C,172C 'createfilterforstream':81C 'cve':15A,23A,215C,218C 'cwe':27B 'decodeparm':11A,46B 'denial':69B 'derefer':6A,37B,76C,134C,163C 'detail':117C 'dictionari':93C 'dos':212C 'earli':130C,193C 'earlychang':13A,49B,99C,129C,136C,149C,183C 'earlyobj':126C,131C,161C,192C,194C 'empti':181C 'exist':78C 'exit':184C 'fhp4':20A 'file':118C,222C 'filter':9A 'fix':189C 'getvalu':132C,162C,195C 'ghsa':19A 'ghsa-fhp4-pr5j-46m5':18A 'github.com':225C 'github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)':224C 'impact':196C 'indecodeparam':124C,128C,141C 'key':14A,50B,100C,137C,150C 'lack':47B,147C 'latest':115C 'line':120C 'lzwdecod':8A,43B 'malici':169C 'muhammara':1A,26A,29B,33B,113C,204C 'non':144C 'non-nul':143C 'npm':30B 'null':4A,39B,74C,133C,145C,154C,157C,159C,164C 'omit':12A 'packag':31B 'parser':36B 'pdf':32B,35B,57B,85C,170C,175C 'pdfobjectcastptr':125C,156C 'pdfparser':80C 'pdfs':201C 'poc':166C,221C 'poc_muhammara_lzw_null.js':223C 'pointer':5A,40B,75C 'pr5j':21A 'process':61B,83C,110C 'querydictionaryobject':127C,152C 'read':63B,206C 'return':153C 'servic':71B 'similar':213C 'src/deps/pdfwriter/pdfparser.cpp':119C 'startreadingfromstream':174C 'stream':44B,64B,86C,207C 'summari':72C 'suppli':54B 'trigger':171C 'untrust':200C 'use':203C 'version':112C 'via':173C 'violat':105C,188C 'vulner':77C,116C,210C 'wrap':158C","nicknames":[],"mitigations":[],"who_affected":"Applications that accept untrusted PDF files and use muhammara to read stream contents are exposed to a crash. Projects that only generate PDFs or never process uploaded PDFs are unlikely to be reached by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["muhammara"],"ptokens":["muhammara"],"labels":["cwe476","high","muhammara","npm","package","pdf"],"campaign_type":null,"search_a":"'-125107':17A,25A '-2026':16A,24A '46m5':22A 'cve':15A,23A 'decodeparm':11A 'derefer':6A 'earlychang':13A 'fhp4':20A 'filter':9A 'ghsa':19A 'ghsa-fhp4-pr5j-46m5':18A 'key':14A 'lzwdecod':8A 'muhammara':1A,26A 'null':4A 'omit':12A 'pointer':5A 'pr5j':21A","search_b":"'-476':28B 'attack':52B 'caus':68B 'content':65B 'craft':56B 'crash':59B 'cwe':27B 'decodeparm':46B 'denial':69B 'derefer':37B 'earlychang':49B 'key':50B 'lack':47B 'lzwdecod':43B 'muhammara':29B,33B 'npm':30B 'null':39B 'packag':31B 'parser':36B 'pdf':32B,35B,57B 'pointer':40B 'process':61B 'read':63B 'servic':71B 'stream':44B,64B 'suppli':54B","search_c":"'-2022':216C,219C '-39381':220C '-41957':217C '/decodeparms':92C,180C '/filter':88C,177C '/lzwdecode':89C,178C '/user-attachments/files/27186113/poc_muhammara_lzw_null.js)':226C '0xc0000005':106C,186C '1':151C '2':155C '2107':121C '3':160C '460':167C '6.0.4':114C 'absent':139C 'accept':199C 'access':104C,187C 'affect':111C 'applic':198C 'byte':168C 'caus':102C 'code':185C 'contain':97C,176C 'content':208C 'cpp':122C,190C 'crash':108C,165C,172C 'createfilterforstream':81C 'cve':215C,218C 'derefer':76C,134C,163C 'detail':117C 'dictionari':93C 'dos':212C 'earli':130C,193C 'earlychang':99C,129C,136C,149C,183C 'earlyobj':126C,131C,161C,192C,194C 'empti':181C 'exist':78C 'exit':184C 'file':118C,222C 'fix':189C 'getvalu':132C,162C,195C 'github.com':225C 'github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)':224C 'impact':196C 'indecodeparam':124C,128C,141C 'key':100C,137C,150C 'lack':147C 'latest':115C 'line':120C 'malici':169C 'muhammara':113C,204C 'non':144C 'non-nul':143C 'null':74C,133C,145C,154C,157C,159C,164C 'pdf':85C,170C,175C 'pdfobjectcastptr':125C,156C 'pdfparser':80C 'pdfs':201C 'poc':166C,221C 'poc_muhammara_lzw_null.js':223C 'pointer':75C 'process':83C,110C 'querydictionaryobject':127C,152C 'read':206C 'return':153C 'similar':213C 'src/deps/pdfwriter/pdfparser.cpp':119C 'startreadingfromstream':174C 'stream':86C,207C 'summari':72C 'trigger':171C 'untrust':200C 'use':203C 'version':112C 'via':173C 'violat':105C,188C 'vulner':77C,116C,210C 'wrap':158C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-26T20:55:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fhp4-pr5j-46m5","url":"https://github.com/advisories/GHSA-fhp4-pr5j-46m5","severity":"high","published_at":"2026-06-26T20:55:18+00:00","modified_at":"2026-11-09T21:29:44+00:00","first_seen_at":"2026-11-09T21:29:57+00:00","fetched_at":"2026-11-09T21:50:41+00:00","note":null}],"documents":[{"id":110109,"url":"https://api.github.com/repos/julianhille/MuhammaraJS/security-advisories/GHSA-fhp4-pr5j-46m5","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110110,"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110111,"url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}