music-metadata CVE-2026-107390

Requires an application to pass an attacker-supplied MP4-family file (MP4/M4A and related ISO-BMFF formats) to music-metadata < 11.16.0 for parsing. The malicious file must set a 64-bit extended atom size (the extended-size header path) that exceeds the actual file, in an atom whose payload is read via readToken - specifically mvhd, stsd, stsz, or date. No authentication and no user interaction beyond supplying the file are needed (PR:N/UI:N). Limiting factors: exploitation is only possible where the deployment actually ingests untrusted media (e.g., upload/processing pipelines); the impact is confined to denial of service (large allocation or process failure) with no data exposure or code execution, and the trigger is non-default in the sense that it requires the app to parse attacker-controlled files.

This is a genuine but bounded-severity issue. The signals are internally consistent and point to a denial-of-service, not a compromise: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores availability-only impact with no confidentiality or integrity loss, which matches CWE-789 (memory allocation with excessive size value) and the description of an oversized allocation/process failure. SSVC agrees it is a lower-urgency item: Exploitation=poc (not active), Automatable=no, Technical Impact=partial. EPSS is very low at 0.13% (2nd percentile) and the CVE is NOT on CISA KEV, so there is no evidence of real-world exploitation - only publicly available exploit code (the fix PR/commit demonstrate the triggering condition). The 7.5 'HIGH' rating is driven entirely by network reachability plus no-auth/no-interaction, not by impact breadth; this is a classic high-CVSS-but-moderate-real-risk case where the worst outcome is a crash or memory exhaustion of a process that parses untrusted media. Note one nuance to verify: AV:N presumes the malicious file reaches the parser over a network path; for a library, actual exposure depends on whether the embedding application ingests untrusted MP4-family files (e.g., user uploads) - true AV:N requires that deployment pattern.

An attacker uploads or supplies a tiny, malformed MP4/M4A file to an application that uses music-metadata < 11.16.0 to extract media metadata. The file declares a 64-bit extended atom size far larger than the real file in an atom such as mvhd, stsd, stsz, or date; the parser converts this to a JavaScript Number and attempts a readToken/allocation of that size before validating end-of-input, causing a large allocation attempt or process crash and denying service. Exploit code demonstrating the trigger is publicly available via the vendor fix PR and commit (SSVC exploitation=poc).