CVE-2026-104266

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

UBUNTU-CVE-2026-104266

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

GHSA-24CC-9352-H2PG tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

Impact An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag. Patches The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path th...

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

Impact An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag. Patches The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path th...

Infinite loop

Overview tinytag is a Read audio file metadata Affected versions of this package are vulnerable to Infinite loop via the traverseatoms method in tinytag.py when parsing a malformed MP4 file. An attacker can supply an MP4 file containing an atom with an invalid or zero size value, causing the pars...

CVE-2026-104266

A flaw was found in tinytag. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted M4A audio file. When parsing a file containing a zero-sized sub-atom within a custom metadata atom, the parser fails to advance through the input stream, triggering an infinite loop a...

CVE-2026-104266

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

EUVD-2026-102209

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

CVE-2026-104266 tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

CVE-2026-104266 tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

CVE-2026-104266

The tinytag Python library (versions 2.0.0 to 2.3.0 ) is vulnerable to a Denial of Service (DoS) condition when parsing specific M4A files. The root cause is an infinite loop triggered when the metadata parser encounters a sub-atom with a size of zero inside a ---- atom . During custom-field atom...

CVE-2026-104266

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

CVE-2026-104266: Loop with Unreachable Exit Condition

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed...

PT-2026-115064

Name of the Vulnerable Software and Affected Versions tinytag versions 2.0.0 through 2.2.f Description A flaw in the metadata parser allows a specially crafted M4A file to cause a denial-of-service. When the file contains a sub-atom with a size of zero inside a ---- atom, the custom-field atom...

ahwaz (2.2.3), arseinrubika (>=4.8.0, <=5.4.4) +7 more potentially affected by CVE-2026-32889 via tinytag (1.8.1)

tinytag PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - ahwaz 2.2.3 - arseinrubika =4.8.0, =3.8.5, =2.7.5, =1.92.0, =1.113.0 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...

PYSEC-2026-3386 Denial of service via non-terminating SYLT frame parsing loop in tinytag

Summary tinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsin...

melon-music-player (3.0.0a0) potentially affected by CVE-2026-32889 via tinytag (0.18.0)

tinytag PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - melon-music-player 3.0.0a0 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...

Denial of service via non-terminating SYLT frame parsing loop in tinytag

Summarytinytag 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing...

arkive (>=0.1.1, <=0.3.1), arsein (>=7.8.2, <=7.8.6) +33 more potentially affected by CVE-2026-32889 via tinytag (1.10.1)

tinytag PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - arkive =0.1.1, =7.8.2, =7.0.0, =0.0.20, =1.0.0, =1.9.0, =0.1.0, =1.1.0b12, =0.1.41, =0.1.0, =0.1.0, =0.1.1 - mdinfo-macos 0.1.0 and more Source...

helperpy (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-32889 via tinytag (1.5.0)

tinytag PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - helperpy =0.0.1, =0.0.4 Source cves: CVE-2026-32889 Source advisory: OSV:PYSEC-2026-3386...