CVE-2026-107391Medium· 6.2▾ Sunlitmusic-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sam…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.3%
music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.
music-metadata >= 11.14.0, < 11.16.0Upgrade past the affected range:
music-metadata 11.16.0Affected packages:
music-metadata < 11.16.0Patched in:
music-metadata 11.16.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107389Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107387Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107388Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107390Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2022-27781High· 7.5libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a nev…