---
id: "CVE-2026-125107"
page: "https://infrastack.ai/live/CVE-2026-125107"
kind: "vulnerability"
aliases: ["CVE-2026-125107", "GHSA-fhp4-pr5j-46m5"]
title: "Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "muhammara", "fixed": ["6.0.5"], "affected": "<= 6.0.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-476", "muhammara", "npm", "package", "pdf"]
not_affected_if: ["managed-hosting", "no-untrusted-pdfs"]
published_at: "2026-06-26T20:55:18+00:00"
first_seen_at: "2026-11-09T21:29:57+00:00"
updated_at: "2026-11-09T21:31:18+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-fhp4-pr5j-46m5", "first_seen_at": "2026-11-09T21:29:57+00:00"}]
exploit_sources: []
---

# Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Link for people: https://infrastack.ai/live/CVE-2026-125107 (this .md is for agents)

Muhammara's PDF parser dereferences a null pointer when an LZWDecode stream's DecodeParms lacks the EarlyChange key. An attacker who supplies a crafted PDF can crash any process that reads stream contents with it, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:muhammara affected <= 6.0.4 fixed 6.0.5

## How to check

- Check whether the project depends on `muhammara` in `package.json` or the lockfile, and note the installed version.
- Confirm whether the application parses untrusted PDFs with muhammara's stream-reading functions.

## Fix

- `muhammara` `6.0.5`
- Versions up to and including `6.0.4` are affected.

## Timeline

- 2026-11-09T21:29:57+00:00 ghsa https://github.com/advisories/GHSA-fhp4-pr5j-46m5

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/julianhille/MuhammaraJS/security-advisories/GHSA-fhp4-pr5j-46m5
- [advisory] Maintainer's advisory: github.com https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
- [fix] Patch: github.com https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b

## From the sources

## Summary

A NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process.

## Affected Version

muhammara <= 6.0.4 (latest)

## Vulnerability Details

**File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107

```cpp
if (inDecodeParams)
{
    PDFObjectCastPtr<PDFInteger> earlyObj(
        QueryDictionaryObject(inDecodeParams, "EarlyChange")
    );
    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent
}
```

When `inDecodeParams` is non-NULL but lacks the `EarlyChange` key:
1. `QueryDictionaryObject()` returns NULL
2. `PDFObjectCastPtr<PDFInteger>(NULL)` wraps NULL
3. `earlyObj->GetValue()` dereferences NULL → crash

## PoC

460-byte malicious PDF triggers crash via `startReadingFromStream()`:

- PDF contains `/Filter /LZWDecode` with `/DecodeParms << >>` (empty, no EarlyChange)
- Exit code: `0xC0000005` (Access Violation)

## Fix

```cpp
if (earlyObj)
    early = earlyObj->GetValue();
```

## Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

## PoC File
[poc_muhammara_lzw_null.js](https://github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_