Executive brief
Muhammara is a PDF processing library used to parse and extract data from PDF documents. A specially crafted PDF file can cause the application to crash due to a NULL pointer dereference when processing LZW-compressed streams with missing optional parameters. This results in denial of service against any application using the library to read untrusted PDFs.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in PDFParser::CreateFilterForStream() at src/deps/PDFWriter/PDFParser.cpp line 2107. When processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary lacking the EarlyChange key, the code calls QueryDictionaryObject() which returns NULL, then immediately dereferences it via PDFObjectCastPtr::GetValue() without a null check, triggering an access violation (0xC0000005). The attack vector is network-based with no authentication or user interaction required. Any application accepting untrusted PDFs and parsing their streams is vulnerable to denial of service. The fix adds a null pointer check before dereferencing. A 460-byte proof-of-concept PDF triggers the crash.
Affected products
- Muhammara Muhammara 6.0.4 and earlier
Timeline
- 2026-06-26: disclosed: Advisory GHSA-fhp4-pr5j-46m5 published
- 2026-06-22: patched: Fix committed; patch released in version 6.0.5 or later