CVE-2026-32256: falha de alta gravidade em Borewit music-metadata
music-metadata has an infinite loop vulnerability in ASF parser
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.4%
music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Borewit · music-metadataCVEs relacionadas — Borewit music-metadata
No mesmo produto, das mais perigosas para as menos.
CVE-2026-107392MEDIUMmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)EPSS 0.4%CVE-2026-107390MEDIUMmusic-metadata: MP4 parser allows memory exhaustion via oversized extended atom lengthEPSS 0.3%CVE-2026-107391MEDIUMmusic-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masterEPSS 0.3%CVE-2026-107389MEDIUMmusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortEPSS 0.2%CVE-2026-107388MEDIUMmusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSEPSS 0.2%CVE-2026-107387MEDIUMmusic-metadata: Uncontrolled memory allocation in APEv2 parserEPSS 0.2%