Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-125107

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

julianhille MuhammaraJS

  • < 6.0.5affected

References