{"id":"EUVD-2026-95238","enisaUuid":"1a9d3a2f-ed92-370b-9125-577582c48bea","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.","datePublished":"Oct 8, 2026, 7:05:23 PM","dateUpdated":"Oct 9, 2026, 6:32:42 PM","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3\nhttps://github.com/Borewit/music-metadata/pull/2735\nhttps://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58\nhttps://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df\nhttps://github.com/Borewit/music-metadata/releases/tag/v11.16.0\n","aliases":"CVE-2026-107389\nGHSA-5gfj-9q3v-qfp3\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"16a6bd2e-486e-3e9d-a47f-4c31cf7aa1f0","product":{"name":"music-metadata","vendor":{"name":"Borewit"}},"product_version":"\u003c 11.16.0"}],"enisaIdVendor":[{"id":"0d1962a1-a977-3721-bd11-6e592ba5d5f3","vendor":{"name":"Borewit"}}],"enisaIdVulnerability":[{"id":"76e48696-7ec8-3a01-ac7d-e2f5700d8689","vulnerability":{"id":"CVE-2026-107389","description":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.","datePublished":"Oct 8, 2026, 7:05:23 PM","dateUpdated":"Oct 9, 2026, 6:32:42 PM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3\nhttps://github.com/Borewit/music-metadata/pull/2735\nhttps://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58\nhttps://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df\nhttps://github.com/Borewit/music-metadata/releases/tag/v11.16.0\n","enisa_id":"EUVD-2026-95238\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 6, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"f86073c3-5d95-30b7-a131-0dfda79b8c76","product":{"name":"music-metadata","vendor":{"name":"Borewit"}},"product_version":"\u003c 11.16.0"}],"vulnerabilityVendor":[{"id":"cfc9fa12-2ecd-39c2-8cfe-6b333c5754da","vendor":{"name":"Borewit"}}]}},{"id":"8e7b3966-f567-364e-bd68-4856d7f47a31","vulnerability":{"id":"GHSA-5gfj-9q3v-qfp3","description":"music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort","datePublished":"Oct 8, 2026, 7:43:09 PM","dateUpdated":"Oct 8, 2026, 7:43:09 PM","baseScore":0.0,"references":"https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3\nhttps://github.com/Borewit/music-metadata/pull/2735\nhttps://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58\nhttps://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df\nhttps://github.com/Borewit/music-metadata\nhttps://github.com/Borewit/music-metadata/releases/tag/v11.16.0\n","enisa_id":"EUVD-2026-95238\n","aliases":"CVE-2026-107389\nGHSA-5gfj-9q3v-qfp3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}