CVE-2026-104266 tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
Attackers can cause a denial of service in applications using tinytag by providing crafted M4A files that trigger an infinite loop during metadata parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-104266?
CVE-2026-104266 is a medium-severity denial of service vulnerability in tinytag, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.
Weakness: CWE-835
Which versions are affected by CVE-2026-104266?
2 open source packages ship an affected version, including tinytag.
| Package | Affected | Fixed in |
|---|---|---|
tinytag PyPI | From 2.0.0 | 2.3.0 |
tinytag PyPI | From 2.0.0 | 2.3.0 |
How do I fix CVE-2026-104266?
Upgrade tinytag to 2.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-104266 being exploited?
There is no known exploitation of CVE-2026-104266 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-104266, GHSA-24cc-9352-h2pg, UBUNTU-CVE-2026-104266.