CVE-2026-107388: falha de média gravidade em Borewit music-metadata
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.2%
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Borewit · music-metadataCVEs relacionadas — Borewit music-metadata
No mesmo produto, das mais perigosas para as menos.
CVE-2026-32256HIGHmusic-metadata has an infinite loop vulnerability in ASF parserEPSS 0.4%CVE-2026-107392MEDIUMmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)EPSS 0.4%CVE-2026-107390MEDIUMmusic-metadata: MP4 parser allows memory exhaustion via oversized extended atom lengthEPSS 0.3%CVE-2026-107391MEDIUMmusic-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masterEPSS 0.3%CVE-2026-107389MEDIUMmusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortEPSS 0.2%CVE-2026-107387MEDIUMmusic-metadata: Uncontrolled memory allocation in APEv2 parserEPSS 0.2%