CVE-2026-125107

HIGH 7.5

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

CWE	CWE-476
Vendor	julianhille
Product	muhammarajs
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for julianhille muhammarajs

Be the first to know when new high vulnerabilities affecting julianhille muhammarajs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

julianhille / MuhammaraJS

< 6.0.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5 github.com: https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b github.com: https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5