Borewit Music-Metadata up to 11.15.9 APEv2 Parser allocation of resources

Summaryinfo

A vulnerability categorized as problematic has been discovered in Borewit Music-Metadata up to 11.15.9. This impacts an unknown function of the component APEv2 Parser. Such manipulation leads to allocation of resources. This vulnerability is documented as CVE-2026-107387. The attack needs to be performed locally. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Borewit Music-Metadata up to 11.15.9. It has been rated as problematic. Affected by this issue is an unknown functionality of the component APEv2 Parser. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. CVE summarizes:

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-107387 since 10/07/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 11.16.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-95167). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Borewit

Name

• Music-Metadata

Version

• 11.15.0
• 11.15.1
• 11.15.2
• 11.15.3
• 11.15.4
• 11.15.5
• 11.15.6
• 11.15.7
• 11.15.8
• 11.15.9

Website

• Product: https://github.com/Borewit/music-metadata/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion