CVE-2026-107389Medium· 6.2▾ TwilightPoC availablemusic-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before conf…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Exploit / PoC code exists
0.1% → 0.2%
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
music-metadata < 11.16.0Patched in:
music-metadata 11.16.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107387Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107388Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107390Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107391Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-77301High· 7.5adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js