VulnSocial

CVE-2026-32256Disclosure(borewit / music-metadata)

LOWCVSS 7.5 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue.

borewit CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-835

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • music-metadata

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • 4 total mentions across 1 day

Affected systems

Vendors
borewit
Products
music-metadata

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-03-18: 4Technical Details · 2026-03-18: 303-18
Signal classification2 categories
Disclosure
250.0%
General
250.0%
Referenced assets4 URLs
Full discourse4 posts
  • CVE@CVEnew
    General

    CVE-2026-32256 music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfPa… https://www.cve.org/CVERecord?id=CVE-2026-32256

    Post summary

    A brief announcement of CVE-2026-32256 impacting the music-metadata library prior to version 11.12.3, with limited technical detail but no PoC, exploit, or patch information.

    0001064
    56.7K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 music-metadata, Infinite Loop DoS, #CVE-2026-32256 (Critical) https://dailycve.com/music-metadata-infinite-loop-dos-cve-2026-32256-critical/

    Post summary

    The post announces a critical DoS vulnerability (CVE‑2026‑32256) in the music‑metadata library, describing an infinite loop that leads to a denial of service, without providing any PoC, exploit code, or mitigation details.

    0000023
    169 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-32256 Infinite Loop Vulnerability in music-metadata ASF Parser Before 11.12.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32256

    Post summary

    The content announces a new infinite‑loop vulnerability (CVE‑2026‑32256) in music‑metadata ASF parser before 11.12.3, with minimal additional details and no evidence of exploitation or patch information.

    0000039
    4.0K followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-32256 📊 Severity: 7.5 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-32256 #CVE-2026-32256 #CVE #High  #CyberSecurity #InfoSec https://t.co/eqz8ctAIbl

    Post summary

    The tweet merely announces CVE‑2026‑32256 with a severity score and a link to NVD, offering no further technical or actionable details.

    0000030
    104 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appborewitmusic-metadata---

Explore more

Back to dashboardborewit CVEsmusic-metadata vulnerabilities