{"id":"EUVD-2026-95169","enisaUuid":"ab57e8b6-06f6-3f66-be35-7374ac312946","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.","datePublished":"Oct 8, 2026, 7:00:24 PM","dateUpdated":"Oct 14, 2026, 2:44:54 AM","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55\nhttps://github.com/Borewit/music-metadata/pull/2743\nhttps://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7\nhttps://github.com/Borewit/music-metadata/releases/tag/v11.16.0\n","aliases":"CVE-2026-107388\nGHSA-jjpr-9cvf-cq55\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"adafae93-4501-3823-8a0f-29a18a22789f","product":{"name":"music-metadata","vendor":{"name":"Borewit"}},"product_version":"\u003c 11.16.0"}],"enisaIdVendor":[{"id":"18251cfa-4bfe-3905-8745-aefaae01b8fa","vendor":{"name":"Borewit"}}],"enisaIdVulnerability":[{"id":"1bb43bd1-7654-3223-9d92-f72d78b1d762","vulnerability":{"id":"CVE-2026-107388","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.","datePublished":"Oct 8, 2026, 7:00:24 PM","dateUpdated":"Oct 14, 2026, 2:44:54 AM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55\nhttps://github.com/Borewit/music-metadata/pull/2743\nhttps://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7\nhttps://github.com/Borewit/music-metadata/releases/tag/v11.16.0\n","enisa_id":"EUVD-2026-95169\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Nov 1, 2026, 4:04:53 AM","vulnerabilityProduct":[{"id":"ed44f9f8-9b64-38e7-9e45-f939295f8b7e","product":{"name":"music-metadata","vendor":{"name":"Borewit"}},"product_version":"\u003c 11.16.0"}],"vulnerabilityVendor":[{"id":"d9803e23-6ef9-3a07-9e86-884399e6a44b","vendor":{"name":"Borewit"}}]}},{"id":"fde2f37f-5e96-3e15-8fa6-736de956209b","vulnerability":{"id":"GHSA-jjpr-9cvf-cq55","description":"music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS","datePublished":"Oct 8, 2026, 7:43:17 PM","dateUpdated":"Oct 8, 2026, 7:43:17 PM","baseScore":0.0,"references":"https://github.com/Borewit/music-metadata/security/advisories/GHSA-jjpr-9cvf-cq55\nhttps://github.com/Borewit/music-metadata/pull/2743\nhttps://github.com/Borewit/music-metadata/commit/b033db675b913a9dba1d29135ec3c10eae7095a7\nhttps://github.com/Borewit/music-metadata\nhttps://github.com/Borewit/music-metadata/releases/tag/v11.16.0\n","enisa_id":"EUVD-2026-95169\n","aliases":"CVE-2026-107388\nGHSA-jjpr-9cvf-cq55\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}