CVE-2026-125107 | BDVDB-2026-402486 Detail

Description#

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-09Record published in the CVE List.
2. Version 22026-11-10Most recent update recorded in the CVE List.