Executive brief
muhammara and Hummus are popular JavaScript libraries used to parse and manipulate PDF files. A vulnerability in how these libraries handle maliciously crafted PDF files can cause them to crash due to a null pointer error, resulting in denial of service. Applications relying on these libraries to process PDFs—particularly from untrusted sources—could become unavailable when processing a specially crafted malicious PDF.
Technical details
The vulnerability is a NULL pointer dereference (CWE-690) triggered by incomplete error handling in PDF parsing logic. When a maliciously crafted PDF file is supplied to either muhammara or Hummus, a function call can return NULL on error, but the library does not validate this return value before dereferencing it. This causes the application to crash with an uncaught null pointer exception. The attack requires only network access and no authentication or user interaction—an attacker can remotely trigger the crash by submitting a malicious PDF to any application using these libraries to process untrusted input. Patches are available: muhammara 2.6.1 and 3.1.1, and Hummus 1.0.111.
Affected products
- Julian Hille muhammara before 2.6.1, 3.0.0 to before 3.1.1
- Gal Kahana Hummus all versions before 1.0.111
Timeline
- 2022-11-01: disclosed
- 2022-11-01: patched: muhammara patched in 2.6.1 and 3.1.1; Hummus patched in 1.0.111