High

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Disclosed: 26.06.2026
Updated: 11.10.2026 10:22

Summary

A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.

Affected Version

muhammara <= 6.0.4 (latest)

Vulnerability Details

File: src/deps/PDFWriter/PDFParser.cpp line 2107

cpp

if (inDecodeParams)
{
    PDFObjectCastPtr<PDFInteger> earlyObj(
        QueryDictionaryObject(inDecodeParams, "EarlyChange")
    );
    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent
}

When inDecodeParams is non-NULL but lacks the EarlyChange key:

QueryDictionaryObject() returns NULL
PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
earlyObj->GetValue() dereferences NULL → crash

PoC

460-byte malicious PDF triggers crash via startReadingFromStream():

PDF contains /Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)
Exit code: 0xC0000005 (Access Violation)

Fix

cpp

if (earlyObj)
    early = earlyObj->GetValue();

Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

PoC File

poc_muhammara_lzw_null.js

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	muhammara	< 6.0.5	6.0.5

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Platform: npm
Package: muhammara
Disclosed: 26.06.2026
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-fhp4-pr5j-46m5 - CC BY 4.0

Vulnerability history: muhammara

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 5
First → latest: 11.2022 06.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 5

Disclosures per year

2022: 4
2023: 0
2024: 0
2025: 0
2026: 1

26.06.2026

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key this entry

High · 7.5 ghsa-fhp4-pr5j-46m5 < 6.0.5 6.0.5
05.12.2022

muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference

High · 7.5 CVE-2022-41957 >= 3.0.0, < 3.4.0, < 2.6.2 3.4.0, 2.6.2
02.11.2022

Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp

High · 7.5 CVE-2022-39381 < 2.6.0 2.6.0
01.11.2022

muhammara and hummus vulnerable to denial of service by NULL pointer dereference

High · 7.5 CVE-2022-25892 < 2.6.1, >= 3.0.0, < 3.1.1 2.6.1, 3.1.1
01.11.2022

muhammara and hummus vulnerable to null pointer dereference on bad response object

High · 7.5 CVE-2022-25885 < 2.6.0 2.6.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application