CVE-2026-107387: medium-severity vulnerability in Borewit music-metadata
music-metadata: Uncontrolled memory allocation in APEv2 parser
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.2epss 0.2%
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Borewit · music-metadataRelated CVEs — Borewit music-metadata
In the same product, most dangerous first.
CVE-2026-32256HIGHmusic-metadata has an infinite loop vulnerability in ASF parserEPSS 0.4%CVE-2026-107392MEDIUMmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)EPSS 0.4%CVE-2026-107390MEDIUMmusic-metadata: MP4 parser allows memory exhaustion via oversized extended atom lengthEPSS 0.3%CVE-2026-107391MEDIUMmusic-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masterEPSS 0.3%CVE-2026-107389MEDIUMmusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortEPSS 0.2%CVE-2026-107388MEDIUMmusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSEPSS 0.2%