music-metadata CVE-2026-107388

Requires an application running music-metadata prior to 11.16.0 that parses attacker-supplied audio/video input containing an ID3v2 tag (e.g., audio/mpeg MP3 passed through parseBuffer/parseFile). The specific trigger is an ID3v2 header whose syncsafe tag-size field declares a large body (up to 268435455 bytes ≈ 268 MiB) while the file is truncated so the declared bytes are absent. LIMITING FACTORS: the attacker must be able to get a file into the parser (e.g., an upload or ingestion feature); a single file yields only a bounded, transient allocation that is freed after the caught EndOfStreamError, so durable denial-of-service requires high volume or concurrency of crafted files; impact is availability only (no data read or integrity change). No authentication is required by the library itself (PR:N), but the enclosing application's access controls on its file-ingestion path may constrain who can submit files.

This is a resource-exhaustion flaw (CWE-789, Memory Allocation with Excessive Size Value) in the ID3v2 parser of the music-metadata library, confirmed and fixed by the vendor in v11.16.0. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2 MEDIUM) rates only availability impact - consistent with the description, since the bug causes a large (~268 MiB) heap allocation, not data exposure. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied, so there is no evidence of active or widespread exploitation; however, the fix commit/test publicly contains the exact 10-byte trigger vector, lowering the barrier to reproduction. Two signals are in tension and should be weighed down: (1) the description notes the allocation SUCCEEDS, the subsequent read hits EndOfStreamError which is caught, and the caller still receives a normal metadata object - meaning a single file produces a transient, bounded ~268 MiB spike that is freed, not a guaranteed crash, so NVD's A:H may overstate per-request impact; realistic denial-of-service requires concurrent or repeated parsing of many crafted files for amplification. (2) The AV:L (local) rating is appropriate for the library in isolation, but in the common deployment where an application parses user-uploaded audio/video, the attacker-controlled file arrives over the network, making the practical exposure closer to remote - verify against your own ingestion path. Net: a legitimate-to-fix MEDIUM availability/DoS issue, not a high-urgency critical; prioritize patching for services that parse untrusted uploads at volume.

An attacker uploads a truncated audio file containing only a crafted ID3v2 header whose syncsafe tag-size field declares a body of ~268 MiB; an application using music-metadata < 11.16.0 to parse the upload allocates the full declared buffer before validating that the bytes exist. Repeating this across many concurrent uploads drives memory pressure and can exhaust host memory, degrading or crashing the parsing service. The fix PR's test includes a minimal 10-byte trigger (ID3 header with size bytes 0x7f 0x7f 0x7f 0x7f = 268435455), so a working trigger input is publicly documented even though no weaponized exploit is reported.