CVE-2026-125107
7.5 HIGHpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476
Public exploit & PoC references
- https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b
- https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5
- https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
- https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
All references
- https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b
- https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5
- https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
- https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2025-29895
- UNSCOREDCVE-2025-29896
- MEDIUMCVE-2025-60469PoC
- MEDIUMCVE-2025-60479PoC
- MEDIUMCVE-2025-60487PoC
- MEDIUMCVE-2025-60489PoC
- MEDIUMCVE-2025-60493PoC
- MEDIUMCVE-2026-100348PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.