CVE-2026-107391

The music-metadata metadata parser for audio and video files is vulnerable to a synchronous infinite loop (DoS) in its MP4 stsd sample-description parser. This regression allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing, while an attacker-c...