GHSA-JJPR-9CVF-CQ55 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the ID3v2 tag parser in lib/id3v2/ID3v2Parser.ts, where a declared tag size in an ID3v2...

NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

CVE-2026-107388

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

CVE-2026-107388

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

CVE-2026-107388 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

CVE-2026-107388 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

CVE-2026-107388

The music-metadata metadata parser for audio and video files is vulnerable to a memory exhaustion Denial of Service (DoS) . Prior to version 11.16.0 , the ID3v2 parser failed to validate the syncsafe tag-size field before allocating memory for the tag body. An attacker can provide a truncated fil...

EUVD-2026-95169

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

CVE-2026-107388 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

PT-2026-108151

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before verifying if the input contains the declared bytes. A specially crafted file such as MP3, FLAC,...

PT-2026-108661

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

CVE-2026-107388: Memory Allocation with Excessive Size Value

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can reques...

Rocky Linux 8 [CIQ] Security Update: exempi / exempi-debuginfo / exempi-debugsource / exempi-devel Multiple Vulnerabilities (crlsa-2024_3066)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243066 advisory. exempi: denial of service via opening of crafted audio file with ID3V2 frame CVE-2020-18651 exempi: denial of service via opening of crafted webp file...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1748639719)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748639719 advisory. - GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer before version 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer-plugins-base (UTSA-2026-093188)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093188 advisory. GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. Tenable has extracted the preceding description block directly from the...

CVE-2026-51275

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-49927

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a denial of service application crash, information disclosure, or potential arbitrary code execution via a crafted MP3 file. The vulnerabili...