{"id":"EUVD-2026-95245","revision":"f46457bb913b498ba874d1d8a65eec69","records":[{"revision":"f46457bb913b498ba874d1d8a65eec69","observedAt":"2026-11-03T03:01:49.47+00:00","statement":{"source":"euvd","id":"EUVD-2026-95245","aliases":["CVE-2026-107391","GHSA-f94x-6692-553q"],"title":"music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample…","description":"music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":null}],"references":["https://github.com/Borewit/music-metadata/security/advisories/GHSA-f94x-6692-553q","https://github.com/Borewit/music-metadata/pull/2734","https://github.com/Borewit/music-metadata/commit/90a7d52c69e921a0b019592d887acd97b1c8b8a5","https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95245","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2026, 7:10:47 PM","dateUpdated":"Oct 9, 2026, 3:14:19 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95245","identifiers":["EUVD-2026-95245","CVE-2026-107391","GHSA-f94x-6692-553q"]},"retained":false,"historicalAffected":[]}],"coverage":[]}