CVE-2026-104266: tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
References
- github.com/advisories/GHSA-24cc-9352-h2pg
- github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e
- github.com/tinytag/tinytag/pull/326
- github.com/tinytag/tinytag/releases/tag/2.3.0
- github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg
- nvd.nist.gov/vuln/detail/CVE-2026-104266
Code Behaviors & Features
Detect and mitigate CVE-2026-104266 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →