A null pointer dereference occurs in the LZWDecode filter of MuhhammaraJS when a streamed PDF includes a DecodeParms dictionary that lacks the EarlyChange key. This flaw causes the PDFParser::CreateFilterForStream() routine to crash upon reading the affected stream, potentially rendering the application that processes the PDF unavailable. The weakness is a classic null pointer dereference (CWE‑476).

The vulnerability affects the MuhammaraJS package provided by julianhille. Versions older than 6.0.5 are impacted; the fix was applied in the 6.0.5 release and later. Users running any Node or Electron application that incorporates MuhhammaraJS to process PDFs should verify their installed version.

The CVSS score of 7.5 indicates a high severity, and the absence of an EPSS score or KEV listing suggests the vulnerability is known but exploitation data is currently unavailable. An attacker can trigger the crash by crafting a PDF that uses the LZWDecode filter without the EarlyChange key and delivering it to an application that processes PDFs with MuhammaraJS. The impact is limited to availability—no direct compromise of confidentiality or integrity can be inferred from the supplied data. Consequently, environments that rely on untrusted PDF inputs are at heightened risk of denial of service until patched.