{"id":"CVE-2026-107388","revision":"23b9fe3074b749e8a786138095a72034","records":[{"revision":"23b9fe3074b749e8a786138095a72034","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107388","aliases":[],"title":"music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.","state":0,"publishedAt":"2026-10-08T19:00:24.725+00:00","modifiedAt":"2026-10-14T02:44:54.96+00:00","affected":[{"ecosystem":"Vendor product","name":"music-metadata","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Borewit\",\n                    \"product\": \"music-metadata\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 11.16.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":"MEDIUM"}],"references":["https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55","https://github.com/Borewit/music-metadata/pull/2743","https://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7","https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107388","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107388","identifiers":["CVE-2026-107388"]},"retained":false,"historicalAffected":[]}],"coverage":[]}