tinytag up to 2.2.0 _parse_synced_lyrics infinite loop

Summaryinfo

A vulnerability, which was classified as problematic, was found in tinytag up to 2.2.0. Affected by this vulnerability is the function _parse_synced_lyrics. The manipulation results in infinite loop. This vulnerability is known as CVE-2026-32889. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in tinytag up to 2.2.0. It has been classified as problematic. Affected is the function _parse_synced_lyrics. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. CVE summarizes:

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. The root cause is that _parse_synced_lyrics assumes _find_string_end_pos always returns a position greater than the current offset. That assumption is false when no string terminator is present in the remaining frame content. This issue has been fixed in version 2.2.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-32889 since 03/16/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.2.1 eliminates this vulnerability. Applying the patch 44e496310f7ced8077e9087e3774acbaa324b18a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• tinytag

Version

• 2.0
• 2.1
• 2.2.0

License

• open-source

Website

• Product: https://github.com/tinytag/tinytag/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion