CVE-2026-107390 music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length

Medium 6.2 Published 8 Oct 2026 Updated 9 Oct 2026

An attacker can cause denial of service in applications parsing untrusted MP4 files by triggering memory exhaustion via oversized atom lengths.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-107390?

CVE-2026-107390 is a medium-severity denial of service vulnerability in Borewit music-metadata, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.

Weakness: CWE-789

Which versions are affected by CVE-2026-107390?

It affects 1 product.

Products include Borewit Music-Metadata.

How do I fix CVE-2026-107390?

No fix has been published for CVE-2026-107390 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-107390 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107390 exists.

Sources

Also known as GHSA-qc8q-pw95-mq6c.