CVE-2026-107390: music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-08 · updated 2026-10-14
Weakness: CWE-789

Description

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.

Affected products

Borewit music-metadata: before 11.16.0 — fixed in 11.16.0

How to fix

Upgrade to a fixed version: Borewit music-metadata 11.16.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-107390 or the next vulnerability affects your stack