GHSA-927q-g9w9-pm54: Panic in mp3-metadata due to the lack of bounds checking

April 30, 2025 (updated October 31, 2025)

The get_id3() methods used by mp3_metadata::read_from_slice() does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.

Fixed in Fix index error, released as part of 0.4.0.

References

github.com/GuillaumeGomez/mp3-metadata
github.com/GuillaumeGomez/mp3-metadata/issues/36
github.com/GuillaumeGomez/mp3-metadata/pull/37
github.com/advisories/GHSA-927q-g9w9-pm54
rustsec.org/advisories/RUSTSEC-2025-0027.html

Code Behaviors & Features

Detect and mitigate GHSA-927q-g9w9-pm54 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →