GHSA-8j4c-6x6g-rq3jPublished
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107392 · Microsoft / collected KEV context
cve-program · CVE-2026-107392
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/pull/2700
- https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41
- https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
euvd · EUVD-2026-95248
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/pull/2700
- https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41
- https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
nvd · CVE-2026-107392
- https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41
- https://github.com/Borewit/music-metadata/pull/2700
- https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j
osv · GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-8j4c-6x6g-rq3j
- https://github.com/Borewit/music-metadata/pull/2700
- https://github.com/Borewit/music-metadata/commit/e7fc27a96e789d41ece41fdac590fc7618274a41
- https://github.com/Borewit/music-metadata
- https://github.com/Borewit/music-metadata/releases/tag/v11.15.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.