CVE-2026-107387: music-metadata: Uncontrolled memory allocation in APEv2 parser
music-metadata 11.15.0 is vulnerable to uncontrolled memory allocation in the APEv2 parser.
The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes. A small crafted .ape file can declare a very large binary tag item, such as cover art, and force the parser to allocate a large buffer.
This issue is specific to APEv2 parsing and is separate from the ID3v2, MP4, and EBML advisories.
References
- github.com/Borewit/music-metadata/commit/b3bf52cb6021b046f33ba47583e19ab8f10dd235
- github.com/Borewit/music-metadata/pull/2744
- github.com/Borewit/music-metadata/releases/tag/v11.16.0
- github.com/Borewit/music-metadata/security/advisories/GHSA-53v6-4h7p-p4gj
- github.com/advisories/GHSA-53v6-4h7p-p4gj
- nvd.nist.gov/vuln/detail/CVE-2026-107387
Code Behaviors & Features
Detect and mitigate CVE-2026-107387 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →