{"id":"GHSA-fhp4-pr5j-46m5","title":"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key","summary":"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key","severity":"high","cvss":7.5,"cwe":["CWE-476"],"vendor":"muhammara","product":"muhammara","ecosystem":"npm","affected":["muhammara <= 6.0.4"],"patched":["muhammara 6.0.5"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fhp4-pr5j-46m5","references":[{"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5"},{"url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b"},{"url":"https://github.com/advisories/GHSA-fhp4-pr5j-46m5"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-29T13:24:35.258Z","slug":"GHSA-fhp4-pr5j-46m5","body":"## Overview\n\n## Summary\n\nA NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process.\n\n## Affected Version\n\nmuhammara <= 6.0.4 (latest)\n\n## Vulnerability Details\n\n**File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107\n\n```cpp\nif (inDecodeParams)\n{\n    PDFObjectCastPtr<PDFInteger> earlyObj(\n        QueryDictionaryObject(inDecodeParams, \"EarlyChange\")\n    );\n    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent\n}\n```\n\nWhen `inDecodeParams` is non-NULL but lacks the `EarlyChange` key:\n1. `QueryDictionaryObject()` returns NULL\n2. `PDFObjectCastPtr<PDFInteger>(NULL)` wraps NULL\n3. `earlyObj->GetValue()` dereferences NULL → crash\n\n## PoC\n\n460-byte malicious PDF triggers crash via `startReadingFromStream()`:\n\n- PDF contains `/Filter /LZWDecode` with `/DecodeParms << >>` (empty, no EarlyChange)\n- Exit code: `0xC0000005` (Access Violation)\n\n## Fix\n\n```cpp\nif (earlyObj)\n    early = earlyObj->GetValue();\n```\n\n## Impact\n\nAny application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.\n\nSimilar to: CVE-2022-41957, CVE-2022-39381\n\n## PoC File\n[poc_muhammara_lzw_null.js](https://github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)\n\n## Affected packages\n\n- `muhammara <= 6.0.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `muhammara 6.0.5`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}