69 matches found
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107390
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...
NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...
CVE-2026-107391
The music-metadata library (NPM) versions >=11.0.0 and
CVE-2026-107391
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
EUVD-2026-95245
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
EUVD-2026-95244
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...
CVE-2026-107390 music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...
CVE-2026-107390
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...
CVE-2026-107391: Uncontrolled Resource Consumption
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...
PT-2026-108171
Name of the Vulnerable Software and Affected Versions music-metadata versions 11.14.1 through 11.15.x Description A regression in the MP4 stsd sample-description parser allows a crafted MP4-family input to cause a denial of service. By providing a sample-entry size of zero and a specific entry...
CVE-2026-107390: Memory Allocation with Excessive Size Value
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...
PT-2026-108170
Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The MP4 parser accepts an attacker-controlled 64-bit extended atom size and converts it to a JavaScript Number. This resulting payload length is used for atom-specific readToken calls before...
EUVD-2026-39934
A stack overflow in the AP4StsdAtom::AP4StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service DoS via a crafted MP4 file...
CVE-2026-36907
The axiomatic-systems Bento4 multimedia framework versions prior to v1.8.9 are vulnerable to a stack overflow in the AP4_StsdAtom::AP4_StsdAtom component. An attacker can trigger this vulnerability by providing a specially crafted MP4 file , which can result in a Denial of Service (DoS) . To miti...