CVE-2026-104266

MEDIUM 6.5

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

CWE	CWE-835
Vendor	tinytag
Product	tinytag
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for tinytag tinytag

Be the first to know when new medium vulnerabilities affecting tinytag tinytag are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

tinytag / tinytag

>= 2.0.0, < 2.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg github.com: https://github.com/tinytag/tinytag/pull/326 github.com: https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e github.com: https://github.com/tinytag/tinytag/releases/tag/2.3.0