Junglewise Threat Intelligence

CVE-2022-25892: muhammara and Hummus NULL pointer dereference denial of service

CVE-2022-25892 · Severity: low · CVSS 3.1 · Published 2022-11-01

Technologies: Gal Kahana Hummus.

Executive brief

muhammara and Hummus are popular JavaScript libraries used to parse and manipulate PDF files. A vulnerability in how these libraries handle maliciously crafted PDF files can cause them to crash due to a null pointer error, resulting in denial of service. Applications relying on these libraries to process PDFs—particularly from untrusted sources—could become unavailable when processing a specially crafted malicious PDF.

Technical details

The vulnerability is a NULL pointer dereference (CWE-690) triggered by incomplete error handling in PDF parsing logic. When a maliciously crafted PDF file is supplied to either muhammara or Hummus, a function call can return NULL on error, but the library does not validate this return value before dereferencing it. This causes the application to crash with an uncaught null pointer exception. The attack requires only network access and no authentication or user interaction—an attacker can remotely trigger the crash by submitting a malicious PDF to any application using these libraries to process untrusted input. Patches are available: muhammara 2.6.1 and 3.1.1, and Hummus 1.0.111.

Affected products

  • Julian Hille muhammara before 2.6.1, 3.0.0 to before 3.1.1
  • Gal Kahana Hummus all versions before 1.0.111

Timeline

  • 2022-11-01: disclosed
  • 2022-11-01: patched: muhammara patched in 2.6.1 and 3.1.1; Hummus patched in 1.0.111

References