GHSA-FHP4-PR5J-46M5高危已审查

Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

OSV 1.4.0 · github-reviewed · 修改于 2026-06-27 04:55

发布时间

2026-06-27 04:55

GitHub 审查时间

2026-06-27 04:55

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json

公告说明

Summary

A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.

Affected Version

muhammara <= 6.0.4 (latest)

Vulnerability Details

File: src/deps/PDFWriter/PDFParser.cpp line 2107

if (inDecodeParams)
{
    PDFObjectCastPtr<PDFInteger> earlyObj(
        QueryDictionaryObject(inDecodeParams, "EarlyChange")
    );
    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent
}

When inDecodeParams is non-NULL but lacks the EarlyChange key:

QueryDictionaryObject() returns NULL
PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
earlyObj->GetValue() dereferences NULL → crash

PoC

460-byte malicious PDF triggers crash via startReadingFromStream():

PDF contains /Filter /LZWDecode with /DecodeParms << >> (empty, no EarlyChange)
Exit code: 0xC0000005 (Access Violation)

Fix

if (earlyObj)
    early = earlyObj->GetValue();

Impact

Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.

Similar to: CVE-2022-41957, CVE-2022-39381

PoC File

poc_muhammara_lzw_null.js

标识信息

别名 / CVE

无

CWE

CWE-476

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

原始 OSV JSON

{
  "id": "GHSA-fhp4-pr5j-46m5",
  "aliases": [],
  "details": "## Summary\n\nA NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process.\n\n## Affected Version\n\nmuhammara <= 6.0.4 (latest)\n\n## Vulnerability Details\n\n**File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107\n\n```cpp\nif (inDecodeParams)\n{\n    PDFObjectCastPtr<PDFInteger> earlyObj(\n        QueryDictionaryObject(inDecodeParams, \"EarlyChange\")\n    );\n    early = earlyObj->GetValue();  // NULL dereference when EarlyChange key is absent\n}\n```\n\nWhen `inDecodeParams` is non-NULL but lacks the `EarlyChange` key:\n1. `QueryDictionaryObject()` returns NULL\n2. `PDFObjectCastPtr<PDFInteger>(NULL)` wraps NULL\n3. `earlyObj->GetValue()` dereferences NULL → crash\n\n## PoC\n\n460-byte malicious PDF triggers crash via `startReadingFromStream()`:\n\n- PDF contains `/Filter /LZWDecode` with `/DecodeParms << >>` (empty, no EarlyChange)\n- Exit code: `0xC0000005` (Access Violation)\n\n## Fix\n\n```cpp\nif (earlyObj)\n    early = earlyObj->GetValue();\n```\n\n## Impact\n\nAny application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.\n\nSimilar to: CVE-2022-41957, CVE-2022-39381\n\n## PoC File\n[poc_muhammara_lzw_null.js](https://github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)",
  "summary": "Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.5"
            }
          ]
        }
      ],
      "package": {
        "name": "muhammara",
        "ecosystem": "npm"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 6.0.4"
      }
    }
  ],
  "modified": "2026-06-26T20:55:18Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "published": "2026-06-26T20:55:18Z",
  "references": [
    {
      "url": "https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5",
      "type": "WEB"
    },
    {
      "url": "https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b",
      "type": "WEB"
    },
    {
      "url": "https://github.com/julianhille/MuhammaraJS",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-26T20:55:18Z"
  }
}