Denial of Service in tinytag Python Library for MP3 Metadata Parsing

CVE-2026-32889

What is CVE-2026-32889?

The tinytag library, utilized for reading audio file metadata, contains a vulnerability in version 2.2.0 that allows an attacker to exploit the library's handling of MP3 files. Specifically, by supplying crafted MP3 files containing an improperly formatted ID3v2 SYLT frame, an attacker can trigger a non-terminating loop during the parsing process. This results in a denial of service as the library becomes unresponsive, consuming resources indefinitely until the worker process is manually terminated. This flaw stems from an incorrect assumption in the parsing logic, which fails when a string terminator is missing. Users are encouraged to update to version 2.2.1, where this issue has been addressed.

References