CVE-2026-104266Medium· 6.5▾ Sunlittinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-f…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.3%
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
tinytag >= 2.0.0, < 2.3.0Patched in:
tinytag 2.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32889Medium· 6.5tinytag: tinytag: Denial of Service via malicious MP3 file parsing (CVE-2026-32889)
CVE-2026-115774Medium· 4.9Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
CVE-2026-113793Medium· 6.0pypdf: Possible infinite loop when removing tree items
CVE-2026-113792Medium· 6.0pypdf: Possible infinite loop in PdfWriter.find_outline_item
CVE-2026-113794Medium· 6.0pypdf: Possible infinite loop when hitting EOF in standard xref table
CVE-2026-114095Medium· 6.5Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object