{"id":"CVE-2026-125107","published":"2026-11-09T22:18:41.813","lastModified":"2026-11-10T17:17:25.860","description":"Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b","tags":[]},{"url":"https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5","tags":[]},{"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5","tags":[]},{"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5","tags":[]}],"exploitRefs":[{"url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b","tags":[]},{"url":"https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5","tags":[]},{"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5","tags":[]},{"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5","tags":[]}],"hasPoc":true,"ai":null}