CVE-2026-125107 Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125107?
CVE-2026-125107 is a high-severity vulnerability in julianhille MuhammaraJS, published on 9 Nov 2026.
Official description
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.
Weakness: CWE-476
Which versions are affected by CVE-2026-125107?
1 open source package ship an affected version, including muhammara.
| Package | Affected | Fixed in |
|---|---|---|
muhammara npm | All versions | 6.0.5 |
How do I fix CVE-2026-125107?
Upgrade muhammara to 6.0.5 or later.
Is CVE-2026-125107 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-125107 exists.
Sources
Also known as GHSA-fhp4-pr5j-46m5.