CVE-2026-107388
mediummusic-metadata is a metadata parser for audio and video media files.
Vendor / product: Borewit — music-metadata
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.
CVSS
5.5
5.5 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-10-08 19:17
Modified: 2026-10-14 03:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
borewit / music-metadata <11.16.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7
Patch / mitigation: https://github.com/Borewit/music-metadata/pull/2743
Patch / mitigation: https://github.com/Borewit/music-metadata/releases/tag/v11.16.0
References
- https://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7 security-advisories@github.com
- https://github.com/Borewit/music-metadata/pull/2743 security-advisories@github.com
- https://github.com/Borewit/music-metadata/releases/tag/v11.16.0 security-advisories@github.com
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55 security-advisories@github.com
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗