CVE-2026-104266: tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tinytagto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Programs using tinytag to read M4A metadata are exposed if they process attacker-controlled or otherwise untrusted M4A files. The affected versions are 2.0.0 through versions before 2.3.0.
What must an attacker provide to trigger the issue?
The attacker needs to cause the application to parse a crafted M4A file containing a zero-size sub-atom inside a ---- atom. No authentication or privileges are required, but user interaction is required for the application to read the file.
What is the remediation?
Upgrade tinytag to version 2.3.0, which fixes the issue.