music-metadata CVE-2026-107387

The host application must use music-metadata prior to 11.16.0 and feed it an attacker-supplied APE/APEv2 file; the trigger is the attacker-controlled tag-item size field (including cover-art/binary items such as 'Cover Art (Front)'), which is allocated as a Uint8Array before being validated against the remaining tag or file length. Amplification to full memory exhaustion relies on repeated or concurrent parsing of such files. Limiting factors: impact is availability-only (no data exposure or code execution), exploitation requires the application to actually parse untrusted media, and the CVSS base vector treats the attack as local (AV:L) - remote reachability depends on whether the deployment accepts uploaded audio files.

This is a genuine but moderate-priority availability flaw, not a high-severity emergency. The CVSS 6.2 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a local-vector, low-complexity, no-privilege, no-interaction denial of service with no confidentiality or integrity impact - consistent with CWE-789 (memory allocation with excessive size value) and the description's statement that the demonstrated impact is availability loss only. No EPSS score is present in the input and the CVE is not on CISA KEV, so there is no evidence of widespread or active exploitation; exploitation-probability signals are missing rather than conflicting. A reproducer does exist: the vendor's fix PR #2744 ships regression tests that construct a 134-byte crafted APE cover-art file, so working exploit material is effectively public. The main signal tension is AV:L versus real-world reachability - the base score assumes local file supply, but any service that parses attacker-uploaded audio with music-metadata (a common deployment) makes this remotely reachable, which would push the effective vector toward AV:N even though impact stays availability-only. Bottom line: patch-worthy for anyone parsing untrusted media, but it is a resource-exhaustion DoS, not code execution or data exposure.

An attacker submits a small (~134-byte) crafted APE audio file to an application that uses music-metadata < 11.16.0 to extract tags. The APEv2 parser trusts the attacker-controlled tag-item size (e.g., a forged 0x08000000 cover-art item) and allocates a correspondingly huge Uint8Array before validating it against remaining data; repeated or concurrent submissions exhaust process memory and crash the service. A public reproducer is embedded in the vendor's fix regression tests.