CVE-2026-107388 Borewit CVE debrief

Who should care

Defenders responsible for systems using the music-metadata library should assess exposure and prioritize updates to prevent potential memory exhaustion attacks. This includes reviewing system configurations, monitoring for suspicious activity, and ensuring that updates are applied in a timely manner. Additionally, defenders should consider implementing compensating controls, such as validating tag size before allocation, to mitigate the vulnerability.

Why it matters

The vulnerability in the music-metadata library allows for memory exhaustion via a specially crafted MP3 file, potentially leading to Denial of Service (DoS). Defenders should prioritize updates to prevent silent exploitation.

• Memory exhaustion leading to Denial of Service (DoS)
• Potential for silent exploitation without error messages
• Need for validation of tag size before allocation
• Priority for updating to version 11.16.0 or later

Technical summary

The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This vulnerability affects all parsers that support ID3v2 tags (MP3, FLAC, DSF, Musepack) and succeeds silently—callers don't see an error. The vulnerability can be mitigated by updating to version 11.16.0 or later of the music-metadata library.

Defensive priority

Defenders should prioritize updating to version 11.16.0 or later of the music-metadata library to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Update to version 11.16.0 or later of the music-metadata library
• Validate tag size before allocation
• Monitor for suspicious MP3 file activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability affects all parsers that support ID3v2 tags, including MP3, FLAC, DSF, and Musepack. The vulnerability succeeds silently, and callers do not see an error. The ID3v2 parser reads a syncsafe integer representing the tag size (maximum 268,435,455 bytes or 0x0FFFFFFF) and immediately allocates a buffer of that size without checking if the tag size exceeds the remaining file size, if the tag size exceeds a reasonable maximum, or if the subsequent read will actually succeed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.