{"id":"GHSA-fhp4-pr5j-46m5","aliases":[],"url":"https://o3.security/vulnerability/GHSA-fhp4-pr5j-46m5","summary":"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key","details":"## Summary\n\nA NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process.\n\n## Affected Version\n\nmuhammara <= 6.0.4 (latest)\n\n## Vulnerability Details\n\n**File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107\n\n```cpp\nif (inDecodeParams)\n{\n    PDFObjectCastPtr<PDFInteger> earlyObj(\n        QueryDictionaryObject(inDecodeParams, \"EarlyChange\")\n    );\n    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent\n}\n```\n\nWhen `inDecodeParams` is non-NULL but lacks the `EarlyChange` key:\n1. `QueryDictionaryObject()` returns NULL\n2. `PDFObjectCastPtr<PDFInteger>(NULL)` wraps NULL\n3. `earlyObj->GetValue()` dereferences NULL → crash\n\n## PoC\n\n460-byte malicious PDF triggers crash via `startReadingFromStream()`:\n\n- PDF contains `/Filter /LZWDecode` with `/DecodeParms << >>` (empty, no EarlyChange)\n- Exit code: `0xC0000005` (Access Violation)\n\n## Fix\n\n```cpp\nif (earlyObj)\n    early = earlyObj->GetValue();\n```\n\n## Impact\n\nAny application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.\n\nSimilar to: CVE-2022-41957, CVE-2022-39381\n\n## PoC File\n[poc_muhammara_lzw_null.js](https://github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)","published":"2026-06-26T20:55:18Z","modified":"2026-06-26T21:00:09.759527650Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"muhammara","fixedVersion":"6.0.5"}],"fix":{"url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b","label":"julianhille/MuhammaraJS@a98c077"},"references":[{"type":"WEB","url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5"},{"type":"WEB","url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b"},{"type":"PACKAGE","url":"https://github.com/julianhille/MuhammaraJS"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-26T21:00:09.759527650Z"}}