GHSA-fhp4-pr5j-46m5

Summary

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Severity

high

CVSS

7.5

CWE

CWE-476

Published

2026-06-26

Updated

2026-06-26

Advisory details

Summary

A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.

Affected Version

muhammara <= 6.0.4 (latest)

Vulnerability Details

File: src/deps/PDFWriter/PDFParser.cpp line 2107

if (inDecodeParams)
{
    PDFObjectCastPtr<PDFInteger> earlyObj(
        QueryDictionaryObject(inDecodeParams, "EarlyChange")
    );
    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent
}

When inDecodeParams is non-NULL but lacks the EarlyChange key:

1. QueryDictionaryObject() returns NULL
2. PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
3. earlyObj->GetValue() dereferences NULL → crash

PoC

460-byte malicious PDF triggers crash via startReadingFromStream():

• PDF contains /Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)
• Exit code: 0xC0000005 (Access Violation)

Fix

if (earlyObj)
    early = earlyObj->GetValue();

Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

PoC File

poc_muhammara_lzw_null.js

References

• https://github.com/advisories/GHSA-fhp4-pr5j-46m5
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
• https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b

Related advisories

• CVE-2026-55209 — critical · PyPI/resdata
• CVE-2026-76905 — high · Go/github.com/getkin/kin-openapi
• CVE-2026-47427 — high · Go/github.com/github/github-mcp-server
• GHSA-3x6r-wxxg-53vv — medium · Go/github.com/rclone/rclone
• GHSA-jpcw-4wr7-c3vq — medium · Go/github.com/getkin/kin-openapi
• CVE-2026-59949 — medium · Maven/at.yawk.lz4:lz4-java
• CVE-2026-53719 — medium · Go/github.com/envoyproxy/gateway
• CVE-2026-44512 — medium · PyPI/onnx

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity