Kurz gesagt
- CVE-2026-104266 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in tinytag.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.33%, höher als bei 26.5% aller Schwachstellen.
- Abhilfe: auf 2.3.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| tinytag PyPI | ≥ 2.0.0, < 2.3.0
| 2.3.0
|
Description
Impact
An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
Patches
The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.
Workarounds
No workarounds exist. Users must upgrade to tinytag 2.3.0.
NVD description
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free