CVE-2026-107388
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.
| CWE | CWE-789 |
| Vendor | borewit |
| Product | music-metadata |
| Published | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for borewit music-metadata
Be the first to know when new medium vulnerabilities affecting borewit music-metadata are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Borewit / music-metadata
< 11.16.0
References
github.com: https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55 github.com: https://github.com/Borewit/music-metadata/pull/2743 github.com: https://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7 github.com: https://github.com/Borewit/music-metadata/releases/tag/v11.16.0