CVE-2026-107387: fallo de gravedad media en Borewit music-metadata
music-metadata: Uncontrolled memory allocation in APEv2 parser
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.2epss 0.2%
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Borewit · music-metadataCVEs relacionadas — Borewit music-metadata
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-32256HIGHmusic-metadata has an infinite loop vulnerability in ASF parserEPSS 0.4%CVE-2026-107392MEDIUMmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)EPSS 0.4%CVE-2026-107390MEDIUMmusic-metadata: MP4 parser allows memory exhaustion via oversized extended atom lengthEPSS 0.3%CVE-2026-107391MEDIUMmusic-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masterEPSS 0.3%CVE-2026-107389MEDIUMmusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortEPSS 0.2%CVE-2026-107388MEDIUMmusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSEPSS 0.2%