EUVD-2026-95238Published
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirm…
Exact source revision recorded 7 Nov 2026 04:31:24 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107389 · Microsoft / collected KEV context
euvd · EUVD-2026-95238
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3
- https://github.com/Borewit/music-metadata/pull/2735
- https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58
- https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df
- https://github.com/Borewit/music-metadata/releases/tag/v11.16.0
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.