tinytag CVE-2026-104266

Exploitation requires that a program using tinytag versions 2.0.0 through 2.2.x be induced to read an attacker-supplied M4A/MP4 file; the malicious file must contain a '----' custom-field (iTunes freeform) atom enclosing a sub-atom whose declared size is zero, which halts forward progress in the custom-field atom traversal. The primary limiting factor is the UI:R user-interaction requirement - the victim application must actually open and parse the crafted file (e.g., via an upload, library scan, or file-open action); there is no authentication requirement (PR:N) and the default metadata-reading path is affected, so no non-default configuration is needed. Impact is limited to denial of service (process hang) with no data exposure or modification.

This is a genuine but limited-severity availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw affecting ONLY availability (CWE-835 infinite loop) - there is no confidentiality or integrity impact, so the realistic worst case is a hung or unresponsive process, not code execution or data compromise. The UI:R requirement is significant: exploitation depends on a victim program being made to read an attacker-crafted M4A file, which lowers real-world risk below what the 6.5 score alone suggests. No EPSS score, SSVC decision, KEV listing, or published POC/exploit-code reference was provided in the input; per the precision rules this is 'no public exploit identified at time of analysis.' The GitHub Security Advisory (GHSA-24cc-9352-h2pg), fixing PR #326, and the 2.3.0 release are all confirmed, and the PR includes malicious trigger samples (empty_custom_field.m4a / mp4_invalid_size_zero.m4a) as regression tests - these are effectively reproduction files but are not weaponized exploit code. Net: a real, confirmed, easily-reproducible DoS worth patching, but not a high-priority emergency given DoS-only impact and the user-interaction prerequisite.

An attacker crafts an M4A file containing a '----' custom-field atom with a zero-size sub-atom and submits it to an application that uses tinytag 2.0.0-2.2.x to read audio metadata (for example, a media-upload or indexing service). When the application parses the file, the atom-traversal loop stops advancing and spins indefinitely, hanging the thread or process and denying service. No public exploit code was identified, though the fixing PR ships proof-of-concept trigger samples as regression tests.