Skip to main content
cve.nowby Sazabi
← Vulnerabilities
GHSA-FHP4-PR5J-46M5

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Exploited
No known exploitation
Fix
Fixed in 6.0.5
Who is exposed
Not reported

Do first: Upgrade to a fixed version: 6.0.5.

Published
Last modified
17/100 · provisional
43% of muhammara downloads last week were affected versions (29.1K).npm, 67.8K downloads in the last 7 days, read Nov 9, 2026
High (ghsa)
None on Exploit-DB, Metasploit or GitHub

Summary

Muhammara, a PDF library, has a NULL pointer dereference in its LZWDecode filter that crashes the process when it reads a crafted PDF whose DecodeParms dictionary lacks the EarlyChange key. An attacker who can supply such a PDF to an application that reads stream contents can cause a denial of service.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.

Affected Version

muhammara <= 6.0.4 (latest)

Vulnerability Details

File: src/deps/PDFWriter/PDFParser.cpp line 2107

if (inDecodeParams)
{
    PDFObjectCastPtr<PDFInteger> earlyObj(
        QueryDictionaryObject(inDecodeParams, "EarlyChange")
    );
    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent
}

When inDecodeParams is non-NULL but lacks the EarlyChange key:

  1. QueryDictionaryObject() returns NULL
  2. PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
  3. earlyObj->GetValue() dereferences NULL → crash

PoC

460-byte malicious PDF triggers crash via startReadingFromStream():

  • PDF contains /Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)
  • Exit code: 0xC0000005 (Access Violation)

Fix

if (earlyObj)
    early = earlyObj->GetValue();

Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

PoC File

poc_muhammara_lzw_null.js

cve.now Index

17Pcve.now Index 17 of 100 · methodology v3 · provisional
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach10/20Affects npm packages
  • Severity7/10Rated high by ghsa
  • No patch0/5No signal

What would change the score

  • Would score about 72 if added to CISA KEV
  • Would score about 67 if CISA's SSVC rates exploitation active
  • Would score about 39 if advisories confirm default setups are exposed

How the score works · Rankings

Impact

  • Widely used

    muhammara has 56.8k weekly downloads.Source: npmjs.com

    6 packages depend on muhammara.Source: deps.dev

What to do

  • Upgrade to a fixed version: 6.0.5.

Timeline

  1. Advisory published
  2. Record last updated

Affected versions

  • fixed in 6.0.5

    Fixed in 6.0.5 (released May 23, 2026, 34 days before disclosure).

    The latest release, 6.0.6, is not affected.

Evidence 3

  1. Advisory
  2. Repository
  3. Repository

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about GHSA-FHP4-PR5J-46M5

Is GHSA-FHP4-PR5J-46M5 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by GHSA-FHP4-PR5J-46M5?

muhammara (npm): before 6.0.5.Source: cve.now feed data

How do I fix GHSA-FHP4-PR5J-46M5?

Upgrade to a fixed version: 6.0.5.Source: cve.now feed data

Sources

Related

More vulnerabilities