CVE-2026-107390: music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
music-metadatato a version that resolves this vulnerability.Fixed in 11.16.0
Event History
Frequently Asked Questions
Which deployments are exposed to denial of service?
Applications using music-metadata to parse untrusted MP4-family media files are exposed. A small malicious file can trigger a large allocation attempt or cause the parsing process to fail.
What does an attacker need to exploit this issue?
The attacker needs to provide a crafted MP4-family file with an oversized 64-bit extended atom size. The affected parser can reach payload parsing for atoms such as mvhd, stsd, stsz, and date before validating that the declared size fits the input or parent atom.
How can I determine whether my application is affected?
Check the installed music-metadata version and whether the application parses untrusted MP4-family files. Versions earlier than 11.16.0 are affected.
What should be done if immediate remediation is needed?
Upgrade music-metadata to version 11.16.0, which contains the fix. Until upgraded, avoid parsing untrusted MP4-family media where possible.