GHSA-fhp4-pr5j-46m5High· 7.5▾ TwilightMuhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.
muhammara <= 6.0.4 (latest)
File: src/deps/PDFWriter/PDFParser.cpp line 2107
if (inDecodeParams)
{
PDFObjectCastPtr<PDFInteger> earlyObj(
QueryDictionaryObject(inDecodeParams, "EarlyChange")
);
early = earlyObj->GetValue(); // NULL dereference when EarlyChange key is absent
}
When inDecodeParams is non-NULL but lacks the EarlyChange key:
QueryDictionaryObject() returns NULLPDFObjectCastPtr<PDFInteger>(NULL) wraps NULLearlyObj->GetValue() dereferences NULL → crash460-byte malicious PDF triggers crash via startReadingFromStream():
/Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)0xC0000005 (Access Violation)if (earlyObj)
early = earlyObj->GetValue();
Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.
Similar to: CVE-2022-41957, CVE-2022-39381
muhammara <= 6.0.4Upgrade to a patched release:
muhammara 6.0.5Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3739High· 7.1A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’
CVE-2026-1584High· 7.5A flaw was found in gnutls
CVE-2022-49618Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() pdesc could be null but still dereference pdesc->name and it will lead to a null pointer acc…
CVE-2022-49527Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: avoid null dereference in deinit If venus_probe fails at pm_runtime_put_sync the error handling first calls hfi_destroy and afterwards hfi_core_dein…
CVE-2022-49523Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ath11k: disable spectral scan during spectral deinit When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed
CVE-2022-49516Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ice: always check VF VSI pointer values The ice_get_vf_vsi function can return NULL in some cases, such as if handling messages during a reset where the VSI is being r…