{"affected":[{"product":"MuhammaraJS","source":"CNA: GitHub_M","vendor":"julianhille","versions":[{"status":"affected","version":"< 6.0.5"}]}],"cveId":"CVE-2026-125107","cwes":["CWE-476"],"description":"Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794259775198,"publishedAt":1794259775198,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5"}],"remediation":[],"revision":"eae028656d04b9e2bf9151a6e28b05b1a9999e0a3985eacc23c9ccfd7d85252e","sources":[{"modifiedAt":1794259775198,"name":"CNA: GitHub_M","retrievedAt":1794262183652,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125107"}],"ssvc":null,"status":"published","title":"Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key","updatedAt":1794262183652}