GHSA-fhp4-pr5j-46m5 Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Not scored Published 26 Jun 2026

A NULL pointer dereference in the muhammara PDF library allows attackers to cause a denial of service by providing a malicious PDF file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-fhp4-pr5j-46m5?

GHSA-fhp4-pr5j-46m5 is a vulnerability in muhammara, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Summary

A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.

Affected Version

muhammara <= 6.0.4 (latest)

Vulnerability Details

File: src/deps/PDFWriter/PDFParser.cpp line 2107

if (inDecodeParams)
{
    PDFObjectCastPtr&lt;PDFInteger&gt; earlyObj(
        QueryDictionaryObject(inDecodeParams, &#34;EarlyChange&#34;)
    );
    early = earlyObj-&gt;GetValue();  // NULL dereference when EarlyChange key is absent
}

When inDecodeParams is non-NULL but lacks the EarlyChange key:

QueryDictionaryObject() returns NULL
PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
earlyObj->GetValue() dereferences NULL → crash

PoC

460-byte malicious PDF triggers crash via startReadingFromStream():

PDF contains /Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)
Exit code: 0xC0000005 (Access Violation)

Fix

if (earlyObj)
    early = earlyObj-&gt;GetValue();

Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

PoC File

poc_muhammara_lzw_null.js

Which versions are affected by GHSA-fhp4-pr5j-46m5?

2 open source packages ship an affected version, including muhammara.

Package	Affected	Fixed in
`muhammara` npm	All versions	`6.0.5`
`muhammara` npm	All versions	`6.0.5`

How do I fix GHSA-fhp4-pr5j-46m5?

Upgrade muhammara to 6.0.5 or later.

Is GHSA-fhp4-pr5j-46m5 being exploited?

There is no known exploitation of GHSA-fhp4-pr5j-46m5 in the wild and no public exploit code.