Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 26 June 2026.

Which products and versions are affected?

muhammara (npm) SEMVER:introduced=0,fixed=6.0.5.

Is there a fix for This vulnerability?

Yes. muhammara (npm): upgrade to 6.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run muhammara (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Muhammara NULL pointer dereference in LZWDecode filter

Severity: low · CVSS 3.1 · Published 2026-06-26

Muhammara is a PDF processing library used to parse and extract data from PDF documents. A specially crafted PDF file can cause the application to crash due to a NULL pointer dereference when processing LZW-compressed streams with missing optional parameters. This results in denial of service against any application using the library to read untrusted PDFs.

Technologies: muhammara (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 26 June 2026.
Which products and versions are affected?: muhammara (npm) SEMVER:introduced=0,fixed=6.0.5.
Is there a fix for This vulnerability?: Yes. muhammara (npm): upgrade to 6.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run muhammara (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

muhammara (npm): upgrade to 6.0.5 or later
```
npm install muhammara@6.0.5
```

Technical details

The vulnerability is a NULL pointer dereference (CWE-476) in PDFParser::CreateFilterForStream() at src/deps/PDFWriter/PDFParser.cpp line 2107. When processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary lacking the EarlyChange key, the code calls QueryDictionaryObject() which returns NULL, then immediately dereferences it via PDFObjectCastPtr::GetValue() without a null check, triggering an access violation (0xC0000005). The attack vector is network-based with no authentication or user interaction required. Any application accepting untrusted PDFs and parsing their streams is vulnerable to denial of service. The fix adds a null pointer check before dereferencing. A 460-byte proof-of-concept PDF triggers the crash.

Affected products

Muhammara Muhammara 6.0.4 and earlier

Timeline

2026-06-26: disclosed: Advisory GHSA-fhp4-pr5j-46m5 published
2026-06-22: patched: Fix committed; patch released in version 6.0.5 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.