CVE-2026-125107: Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Q: Which deployments are exposed to this denial-of-service issue?

Applications using Muhammara before version 6.0.5 are exposed if they process untrusted PDFs and read a stream using the LZWDecode filter with a DecodeParms dictionary that omits EarlyChange.

Q: Does exploiting the issue require authentication or user interaction?

No. The issue is remotely reachable with low attack complexity, requires no privileges or user interaction, and can crash the affected application when it processes a crafted PDF stream.

Q: What is the remediation?

Upgrade Muhammara to version 6.0.5, which fixes the null pointer dereference in PDFParser::CreateFilterForStream().

Published Nov 9, 2026

Updated

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

Affected Software

1 affected component

npm/muhammara<6.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade muhammara to a version that resolves this vulnerability.
Fixed in 6.0.5

Event History

Nov 9, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Applications using Muhammara before version 6.0.5 are exposed if they process untrusted PDFs and read a stream using the LZWDecode filter with a DecodeParms dictionary that omits EarlyChange.

Does exploiting the issue require authentication or user interaction?

No. The issue is remotely reachable with low attack complexity, requires no privileges or user interaction, and can crash the affected application when it processes a crafted PDF stream.

What is the remediation?

Upgrade Muhammara to version 6.0.5, which fixes the null pointer dereference in PDFParser::CreateFilterForStream().

CVE-2026-125107: Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploiting the issue require authentication or user interaction?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploiting the issue require authentication or user interaction?

What is the remediation?