tinytag CVE debriefs

CVE-2026-104266

A denial-of-service vulnerability exists in tinytag versions 2.0.0 through 2.2.1, where parsing certain M4A files containing invalid atoms can cause an infinite loop. This issue is fixed in tinytag 2.3.0. The vulnerability is caused by a sub-atom with a size of zero in the `----` atom of an M4A file, which makes the parser enter an infinite loop. Defenders should assess exposure and prioritize upgrading t [truncated]