DailyCVE@dailycve
🟠 music-metadata, Uncontrolled Memory Allocation, #CVE-2026-107387 (Medium) -DC-Oct2026-2958 https://dailycve.com/music-metadata-uncontrolled-memory-allocation-cve-2026-107387-medium-dc-oct2026-2958/
0000018
239 followersView on X
CVE-2026-107387
LOWCVSS 6.2 · MEDIUMSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/Borewit/music-metadata/commit/b3bf52cb6021b046f33ba47583e19ab8f10dd235
- https://github.com/Borewit/music-metadata/pull/2744
- https://github.com/Borewit/music-metadata/releases/tag/v11.16.0
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-53v6-4h7p-p4gj
- https://github.com/Borewit/music-metadata/security/advisories/GHSA-53v6-4h7p-p4gj
Weakness type (CWE)
CWE-789
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Deep dive
Activity timeline2 mentions / 1d
Referenced assets2 URLs
Full discourse2 posts
CVE@CVEnewCVE-2026-107387 music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a U… https://www.cve.org/CVERecord?id=CVE-2026-107387
0000051158.1K followersView on X