Memory Allocation Vulnerability in Music Metadata Parser by Borewit

CVE-2026-107388

What is CVE-2026-107388?

The music-metadata parser, used for handling audio and video media files, contains a vulnerability in its ID3v2 parser prior to version 11.16.0. This issue arises because the parser relies on the syncsafe tag-size field to allocate memory for the entire tag body without first validating whether the input data matches the expected size. As a result, a truncated file with only an ID3v2 header can trigger a memory allocation of nearly 268 MiB. This can lead to unexpected behavior as the subsequent read operation results in an end-of-stream scenario, catching an internal EndOfStreamError, and ultimately returning a standard metadata object to the caller. Users should upgrade to version 11.16.0 to mitigate this vulnerability.

References