Borewit music-metadata up to 11.15.x MP4 stsd sample-description parser StsdAtom.get resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in Borewit music-metadata up to 11.15.x. This issue affects the function StsdAtom.get of the component MP4 stsd sample-description parser. This manipulation causes resource consumption. This vulnerability appears as CVE-2026-107391. The attack requires local access. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Borewit music-metadata up to 11.15.x. It has been declared as problematic. Affected by this vulnerability is the function StsdAtom.get of the component MP4 stsd sample-description parser. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-107391 since 10/07/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 11.16.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Borewit

Name

• music-metadata

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15

Website

• Product: https://github.com/Borewit/music-metadata/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion