CVE-2026-107387
Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in music-metadata APEv2 Parser

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in the remaining tag or file data. A small crafted APE file can therefore trigger a disproportionate allocation, including through cover-art items, and repeated or concurrent parsing can exhaust process memory. The demonstrated impact is availability loss only. This issue is fixed in version 11.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107387
EUVD
EUVD-2026-95167

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Borewit music-metadata < 11.16.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the music-metadata library, specifically versions 11.12.3 and below. It involves uncontrolled memory allocation in the APEv2 parser where the parser reads a size value from an input file to allocate memory before verifying if the file contains that many bytes. An attacker can craft a small .ape file with a large declared tag item size, forcing the parser to allocate a disproportionately large buffer. This leads to potential denial of service through memory exhaustion.

Detection Guidance

Detecting this vulnerability requires checking if your system uses vulnerable versions of music-metadata. Inspect installed npm packages with 'npm list music-metadata' or 'npm ls music-metadata'. If the version is 11.12.3 or below, the system is vulnerable. Additionally, monitor for unusual memory usage spikes when processing APE files, as this may indicate exploitation attempts.

Impact Analysis

The primary impact is denial of service due to memory exhaustion. An attacker could send a maliciously crafted APE file to a system using the vulnerable library, causing the application to consume excessive memory and crash or become unresponsive. Confidentiality and integrity impacts are not demonstrated.

Compliance Impact

This vulnerability primarily impacts system availability by causing memory exhaustion through crafted APEv2 files. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged denial-of-service conditions could indirectly impact compliance by disrupting access to personal or health data processing systems.

Mitigation Strategies

Upgrade music-metadata to version 11.16.0 or later using 'npm update music-metadata'. If upgrading is not possible, implement input validation for APE files or block APEv2 parsing entirely. Restrict access to media processing functions to trusted users only to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart