Infinite Loop Vulnerability in Borewit Music Metadata Parser

CVE-2026-32256

What is CVE-2026-32256?

The music-metadata library, used for parsing metadata in audio and video files, contains a vulnerability in its Advanced Streaming Format (ASF) parser. Specifically, the function responsible for processing the ASF Header Extension Object enters an infinite loop when it encounters a sub-object with an object size of zero. This issue can lead to potential disruption in applications that rely on this library for file parsing. The vulnerability has been addressed in version 11.12.3, making an upgrade essential for maintaining system integrity and performance.

References