CVE-2026-125107— Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Quick assessment

Affected

julianhille MuhammaraJS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Muhammara 是一个 Node.js 模块，提供 C/C++ 绑定，用于在 Node.js 或 Electron 环境中通过 JavaScript 修改 PDF 文件。在 6.0.5 版本之前，位于的函数在处理使用 LZWDecode 过滤器且其 DecodeParms 字典中缺少 EarlyChange 键的 PDF 流时，会解引用一个空 PDFInteger 指针。若应用程序处理不可信的 PDF 文件并读取受影响的流，可能导致崩溃，从而引发拒绝服务（DoS）漏洞。该问题已在 6.0.5 版本中修复。

CVSS 7.5 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Source: CVE Program / CVE List V5

Vulnerability Description

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
julianhille	MuhammaraJS	< 6.0.5	-

II. Public POCs for CVE-2026-125107

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125107

请登录查看更多情报信息。

Other References for CVE-2026-125107 (3)

https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5 x_refsource_MISC
https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5 x_refsource_CONFIRM
https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-125107

IV. Related Vulnerabilities

Same product: MuhammaraJS

Same vendor: julianhille

Same weakness: CWE-476