Executive brief
Muhammara, a library used for processing PDF files, is vulnerable to a crash when handling specifically crafted PDF documents. An attacker can provide a malicious PDF that causes the application to stop responding or shut down unexpectedly. This results in a denial-of-service (DoS) condition, potentially disrupting business operations that rely on automated PDF processing.
Technical details
A NULL pointer dereference exists in `PDFParser::CreateFilterForStream()` within `src/deps/PDFWriter/PDFParser.cpp`. When the parser encounters a PDF stream using the `/LZWDecode` filter, it attempts to retrieve the `EarlyChange` key from the `/DecodeParms` dictionary. If the dictionary exists but omits this specific key, `QueryDictionaryObject` returns NULL, which is subsequently dereferenced when calling `GetValue()`. This results in an access violation (0xC0000005) and a denial-of-service. The vulnerability can be triggered remotely without authentication by providing a malformed PDF. A fix is available in version 6.0.5 which adds a null check before accessing the object.
Affected products
- julianhille muhammara <= 6.0.4
Timeline
- 2026-05-23: disclosed: Initial disclosure by reporter
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Fix released in version 6.0.5