Vulnerability in Music Metadata Parser for MP4 Files by Borewit

CVE-2026-107390

What is CVE-2026-107390?

The music-metadata parser, utilized for analyzing audio and video media files, contains a vulnerability that allows oversized payload lengths to be parsed due to insufficient validation of atom sizes in MP4 files. Attackers may exploit this by providing specially crafted MP4-family files that could trigger excessive memory allocation or lead to process failures during parsing. This flaw affects versions prior to 11.16.0, making applications susceptible to denial of service when handling untrusted media files. The issue has been addressed in the latest release.

References