CVE-2026-32256 PUBLISHED

music-metadata has an infinite loop vulnerability in ASF parser

Assigner: GitHub_M
Reserved: 11.03.2026 Published: 18.03.2026 Updated: 18.03.2026

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (parseExtensionObject() in lib/asf/AsfParser.ts:112-158) enters an infinite loop when a sub-object inside the ASF Header Extension Object has objectSize = 0. Version 11.12.3 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor Borewit
Product music-metadata
Versions
  • Version < 11.12.3 is affected

References

Problem Types

  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') CWE