CVE-2026-107388

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0

Description The ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before verifying if the input contains the declared bytes. A specially crafted file (such as MP3, FLAC, DSF, or Musepack) containing only an ID3v2 header can request a memory allocation of up to 268 MiB from a file as small as 10 bytes. Because the resulting EndOfStreamError is caught internally, the process succeeds silently, returning a normal metadata object while leaving the large buffer allocated. This can lead to server memory exhaustion and Denial of Service (DoS) if an attacker uploads multiple truncated files.

Recommendations Update to version 11.16.0.