GHSA-fhp4-pr5j-46m5

Source

https://github.com/advisories/GHSA-fhp4-pr5j-46m5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fhp4-pr5j-46m5

Published

2026-06-26T20:55:18Z

Modified

2026-06-26T21:00:09Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Details

Summary

A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.

Affected Version

muhammara <= 6.0.4 (latest)

Vulnerability Details

File: src/deps/PDFWriter/PDFParser.cpp line 2107

if (inDecodeParams)
{
    PDFObjectCastPtr<PDFInteger> earlyObj(
        QueryDictionaryObject(inDecodeParams, "EarlyChange")
    );
    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent
}

When inDecodeParams is non-NULL but lacks the EarlyChange key:

QueryDictionaryObject() returns NULL
PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
earlyObj->GetValue() dereferences NULL → crash

PoC

460-byte malicious PDF triggers crash via startReadingFromStream():

PDF contains /Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)
Exit code: 0xC0000005 (Access Violation)

Fix

if (earlyObj)
    early = earlyObj->GetValue();

Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

PoC File

poc_muhammara_lzw_null.js

Database specific

{
    "cwe_ids":  [
        "CWE-476"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-26T20:55:18Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / muhammara

Package

Name: muhammara; View open source insights on deps.dev
Purl: pkg:npm/muhammara

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.0.5

Database specific

last_known_affected_version_range

"<= 6.0.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json"