GHSA-5GFJ-9Q3V-QFP3 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

Summary The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer VINT element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array...

NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...

NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...

GHSA-V383-3RW5-Q8RF enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

Summary DsfParser.parseChunks skips an unrecognised chunk's payload with an un-awaited call: js this.tokenizer.ignoreNumberchunkHeader.size - ChunkHeader.len; // lib/dsf/DsfParser.js:51 — no await ChunkHeader.len is 12. A crafted .dsf chunk with id != 'fmt ' and size in 0..11 makes the argument...

NPM: music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

NPM: music-metadata: uncatchable process crash parsing a crafted .dsf residual of GHSA-v6c2-xwv6-8xf7 vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.14.0...

GHSA-8J4C-6X6G-RQ3J music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

Summary DsfParser.parseChunks skips an unrecognised chunk's payload with an un-awaited call: js this.tokenizer.ignoreNumberchunkHeader.size - ChunkHeader.len; // lib/dsf/DsfParser.js:51 — no await ChunkHeader.len is 12. A crafted .dsf chunk with id != 'fmt ' and size in 0..11 makes the argument...

CVE-2026-4692-trust-me-im-in-rdm

CVE-2026-4692 — content processes can declare themselves in RDM Proof of concept for a missing authorization check on BrowsingContext field synchronization: a compromised content process forges a PContent::CommitBrowsingContextTransaction message setting InRDMPane = true on its own top-level...

CVE-2026-106431

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-107392

The music-metadata metadata parser (versions

CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

EUVD-2026-95248

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)

music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...

CVE-2026-107389 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

CVE-2026-107389

The music-metadata metadata parser for audio and video media files is vulnerable to memory exhaustion or process aborts in versions prior to 11.16.0 . The Matroska and WebM EBML parsers fail to validate that a decoded VINT element length fits within its parent or the available input before alloca...

CVE-2026-107389 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

EUVD-2026-95238

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available...

CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...

CVE-2026-106432

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...