{"id":"CVE-2026-104266","aliases":["DEBIAN-CVE-2026-104266","EUVD-2026-102209","GHSA-24cc-9352-h2pg","UBUNTU-CVE-2026-104266"],"status":"published","title":"tinytag: Infinite loop when parsing certain M4A files containing invalid atoms","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00332,"percentile":0.26697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-10-15T17:13:26Z","modified":"2026-10-28T17:50:29Z","fixes":[{"ecosystem":"PyPI","package":"tinytag","fixed_in":["2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"python-tinytag","fixed_in":["2.3.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tinytag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-tinytag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1"}]}],"versions":["2.2.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"tinytag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}],"versions":["2.0.0","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-tinytag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-2"]}],"products":[{"vendor":"tinytag","product":"tinytag"}],"references":[{"url":"https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/tinytag/tinytag/pull/326","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tinytag/tinytag/releases/tag/2.3.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104266","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-24cc-9352-h2pg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104266.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104266","tags":["advisory"]},{"url":"https://github.com/tinytag/tinytag","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-104266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104266","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-104266","title":"tinytag: Infinite loop when parsing certain M4A files containing invalid atoms","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","status":"published","published":"2026-10-15T17:13:26.636Z","modified":"2026-10-21T01:00:05.989Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-102209","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","status":"published","published":"2026-10-15T17:13:26Z","modified":"2026-10-21T01:00:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:59:40.989797Z"}],"ghsa":[{"id":"GHSA-24cc-9352-h2pg","title":"tinytag: Infinite loop when parsing certain M4A files containing invalid atoms","description":"### Impact\nAn M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.\n\n### Patches\nThe issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.\n\n### Workarounds\nNo workarounds exist. Users must upgrade to tinytag 2.3.0.","status":"published","published":"2026-10-15T20:16:47Z","modified":"2026-10-15T20:16:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:41:32.483482Z"}],"nvd":[{"id":"CVE-2026-104266","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","status":"published","published":"2026-10-15T18:17:22.983Z","modified":"2026-10-21T01:17:19.64Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"CVE-2026-104266","title":"tinytag: Infinite loop when parsing certain M4A files containing invalid atoms","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","status":"published","published":"2026-10-15T17:13:26.636Z","modified":"2026-10-28T02:31:11.923024452Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"DEBIAN-CVE-2026-104266","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","status":"published","published":"2026-10-15T18:17:22.983Z","modified":"2026-10-23T17:47:51.37538921Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"GHSA-24cc-9352-h2pg","title":"tinytag: Infinite loop when parsing certain M4A files containing invalid atoms","description":"### Impact\nAn M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.\n\n### Patches\nThe issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.\n\n### Workarounds\nNo workarounds exist. Users must upgrade to tinytag 2.3.0.","status":"published","published":"2026-10-15T20:16:47Z","modified":"2026-10-15T20:30:05.136549303Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"UBUNTU-CVE-2026-104266","description":"tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.","status":"published","published":"2026-10-15T18:17:00Z","modified":"2026-10-28T17:50:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"}]}}