EUVD-2026-42732
GHSA-whwr-vg23-jrwg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to supply crafted audio input; only application availability is affected with no scope change, confidentiality, or integrity impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Denial of service in pdeljanov Symphonia up to version 0.6.0 can be triggered locally by a low-privileged attacker who supplies a crafted audio file to the Metadata Handler component, causing improper resource release and application unavailability. The root cause is CWE-404 (Improper Resource Shutdown or Release) within the metadata parsing subsystem, with no impact on confidentiality or data integrity. A proof-of-concept exploit has been published; however, no patched release exists as the upstream fix (PR #514) remains unmerged at time of analysis.
Technical ContextAI
Symphonia is a pure-Rust audio decoding and media demuxing library maintained by pdeljanov, designed to parse and decode a wide range of audio formats including formats with embedded metadata (e.g., ID3 tags, Vorbis comments, FLAC metadata blocks). The vulnerability resides in the Metadata Handler component, which reads and processes format-specific tag structures during file parsing. CWE-404 (Improper Resource Shutdown or Release) indicates that under certain conditions - likely when parsing malformed or adversarially crafted metadata - internal resources such as memory buffers, iterators, or file handles are not properly closed or deallocated. This resource leak can exhaust available application resources and cause the consuming process to become unresponsive. Affected versions are confirmed as 0.6.0 and below via NVD references and VulDB report; no explicit CPE strings were provided in the source data.
RemediationAI
No released patch is available as of the time of analysis; the upstream fix exists solely as unmerged pull request #514 at github.com/pdeljanov/Symphonia/pull/514. Monitor that repository for PR acceptance and watch for a post-0.6.0 release that incorporates the fix - upgrade to that version once published. As a compensating control, applications processing untrusted audio files via Symphonia should enforce strict input validation and impose file size and format allowlists before invoking the Metadata Handler, reducing the likelihood that malformed metadata reaches the vulnerable code path. Running Symphonia-based processes in resource-constrained environments - such as containers with cgroup memory and CPU ceilings, or sandboxes with restricted file descriptor counts - can bound the denial-of-service impact to a single isolated process rather than affecting broader system availability. These mitigations limit exposure but do not eliminate the underlying flaw.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today