{"id":"CVE-2026-107390","revision":"48784fcd396c4e27a401f414c3382ce8","records":[{"revision":"48784fcd396c4e27a401f414c3382ce8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107390","aliases":[],"title":"music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.","state":0,"publishedAt":"2026-10-08T19:09:08.729+00:00","modifiedAt":"2026-10-09T11:47:21.464+00:00","affected":[{"ecosystem":"Vendor product","name":"music-metadata","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Borewit\",\n                    \"product\": \"music-metadata\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 11.16.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":"MEDIUM"}],"references":["https://github.com/Borewit/music-metadata/security/advisories/GHSA-qc8q-pw95-mq6c","https://github.com/Borewit/music-metadata/pull/2746","https://github.com/Borewit/music-metadata/commit/0f19ad66d71889b1c5f3ba84d4824f079ac4c005","https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107390","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107390","identifiers":["CVE-2026-107390"]},"retained":false,"historicalAffected":[]}],"coverage":[]}