GHSA-927q-g9w9-pm54
Panic in mp3-metadata due to the lack of bounds checking
GHSA-927q-g9w9-pm54 is a medium vulnerability (CVSS 5.5) in mp3-metadata, published April 28, 2025. No source lists public exploit code. Fixed in mp3-metadata 0.4.0.
- Severity
- 5.5 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.4.0mp3-metadata +1 more
Description
The get_id3() methods used by mp3_metadata::read_from_slice() does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.
Fixed in Fix index error, released as part of 0.4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mp3-metadatacrates.io | before 0.4.0 | 0.4.0 |
mp3-metadatacrates.io | 0.0.0-0 up to 0.4.0 | 0.4.0 |
What each source reports
GitHub Advisories Score used
Panic in mp3-metadata due to the lack of bounds checking
The get_id3() methods used by mp3_metadata::read_from_slice() does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.
Fixed in Fix index error, released as part of 0.4.0.
- Record
GHSA-927q-g9w9-pm54- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Panic in mp3-metadata due to the lack of bounds checking
The get_id3() methods used by mp3_metadata::read_from_slice() does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.
Fixed in Fix index error, released as part of 0.4.0.
- Record
GHSA-927q-g9w9-pm54- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0027No score
Panic in mp3-metadata due to the lack of bounds checking
The get_id3() methods used by mp3_metadata::read_from_slice() does not perform adequate bounds
checking when recreating the tag due to the use of desynchronization.
Fixed in Fix index error, released as part of 0.4.0.
- Record
RUSTSEC-2025-0027- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.