Vulnerability-Lookup

CVE-2026-107389 (GCVE-0-2026-107389)

Vulnerability from cvelistv5 – Published: 2026-10-08 19:05 – Updated: 2026-10-09 18:32

Title

music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

Summary

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 18:32 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Borewit/music-metadata/securit…	x_refsource_CONFIRM
https://github.com/Borewit/music-metadata/pull/2735	x_refsource_MISC
https://github.com/Borewit/music-metadata/commit/…	x_refsource_MISC
https://github.com/Borewit/music-metadata/commit/…	x_refsource_MISC
https://github.com/Borewit/music-metadata/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Borewit	music-metadata	Affected: < 11.16.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107389",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T18:32:35.247883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T18:32:42.251Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "music-metadata",
          "vendor": "Borewit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T19:05:23.816Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
        },
        {
          "name": "https://github.com/Borewit/music-metadata/pull/2735",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Borewit/music-metadata/pull/2735"
        },
        {
          "name": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58"
        },
        {
          "name": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df"
        },
        {
          "name": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5gfj-9q3v-qfp3",
        "discovery": "UNKNOWN"
      },
      "title": "music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107389",
    "datePublished": "2026-10-08T19:05:23.816Z",
    "dateReserved": "2026-10-07T21:07:54.988Z",
    "dateUpdated": "2026-10-09T18:32:42.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107389",
      "date": "2026-10-09",
      "epss": "0.00117",
      "percentile": "0.01559"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "music-metadata",
                "vendor": "Borewit",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 11.16.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0."
          }
        ],
        "id": "CVE-2026-107389",
        "lastModified": "2026-10-09T19:16:41.583",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-107389",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T18:32:35.247883Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-08T20:17:33.190",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Borewit/music-metadata/pull/2735"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-789"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-107389",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-09T18:32:35.247883Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-09T18:32:18.095Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "music-metadata",
              "vendor": "Borewit",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 11.16.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-789",
                  "description": "CWE-789: Memory Allocation with Excessive Size Value",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-08T19:05:23.816Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
            },
            {
              "name": "https://github.com/Borewit/music-metadata/pull/2735",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Borewit/music-metadata/pull/2735"
            },
            {
              "name": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58"
            },
            {
              "name": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df"
            },
            {
              "name": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
            }
          ],
          "source": {
            "advisory": "GHSA-5gfj-9q3v-qfp3",
            "discovery": "UNKNOWN"
          },
          "title": "music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-107389",
        "datePublished": "2026-10-08T19:05:23.816Z",
        "dateReserved": "2026-10-07T21:07:54.988Z",
        "dateUpdated": "2026-10-09T18:32:42.251Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-107389

Vulnerability from fkie_nvd - Published: 2026-10-08 20:17 - Updated: 2026-10-09 19:16

Severity

6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58
	security-advisories@github.com	https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df
	security-advisories@github.com	https://github.com/Borewit/music-metadata/pull/2735
	security-advisories@github.com	https://github.com/Borewit/music-metadata/releases/tag/v11.16.0
	security-advisories@github.com	https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "music-metadata",
          "vendor": "Borewit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.16.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0."
    }
  ],
  "id": "CVE-2026-107389",
  "lastModified": "2026-10-09T19:16:41.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107389",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-09T18:32:35.247883Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-08T20:17:33.190",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Borewit/music-metadata/pull/2735"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5GFJ-9Q3V-QFP3

Vulnerability from github – Published: 2026-10-08 19:43 – Updated: 2026-10-08 19:43

Summary

music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

Details

Summary

The Matroska/WebM EBML parser decodes attacker-controlled variable-length integer (VINT) element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and Uint8Array allocations.

A very small crafted .webm, .mkv, or .mka file can therefore cause a disproportionately large allocation, an out-of-memory denial of service, or—in one demonstrated parseFile case—an uncatchable V8 fatal abort.

Impact

Applications that parse untrusted Matroska/WebM media can be denied service. Depending on the input, parser API, and Node.js/V8 version, the demonstrated outcomes include:

a 34-byte input causing an approximately 128 MiB allocation before end-of-input;
a 70-byte input causing a 500 MiB allocation through a binary EBML leaf, with concurrent parses multiplying memory consumption;
a 48-byte file causing an uncatchable V8 fatal abort through parseFile when a leaf declares a length of 32 GiB.

The fatal-abort case was reproduced on music-metadata 11.15.0 with Node.js 26.7.0. It was deterministic across three runs and exited with code 133 despite a surrounding try/catch. The same reporter did not reproduce that fatal abort through parseBuffer on Node.js 20 through 25; those configurations can still encounter allocation attempts or catchable errors. The exact failure mode is therefore runtime- and tokenizer-dependent, but the underlying validation flaw is shared.

The impact is limited to availability; no confidentiality or integrity impact has been demonstrated.

Root cause

EbmlIterator.readElement() decodes an element length from an EBML VINT and converts it to a JavaScript Number:

private async readElement(): Promise<IHeader> {
  const id = await this.readVintData(this.ebmlMaxIDLength);
  const lenField = await this.readVintData(this.ebmlMaxSizeLength);
  lenField[0] ^= 0x80 >> (lenField.length - 1);
  return {
    id: readUIntBE(id, id.length),
    len: readUIntBE(lenField, lenField.length)
  };
}

Before the fix, that value was not checked against the parent boundary or known file size before reaching the leaf readers:

private async readString(e: IHeader): Promise<string> {
  const rawString = await this.tokenizer.readToken(new StringType(e.len, 'utf-8'));
  return rawString.replace(/\x00.*$/g, '');
}

private async readBuffer(e: IHeader): Promise<Uint8Array> {
  const buf = new Uint8Array(e.len);
  await this.tokenizer.readBuffer(buf);
  return buf;
}

An EBML size VINT can encode values approaching 2^56. A crafted file can select a known string, unsigned-integer, binary, or UID element and route its declared size into an allocation before the tokenizer discovers that the input is truncated. The declared length also participates in container-boundary arithmetic.

For lengths around 32 GiB, one reporter observed V8 aborting on its external-memory accounting check:

Fatal error: Check failed: change_in_bytes < kMaxReasonableBytes
process exit code 133

This is a V8 process abort rather than a JavaScript exception, so application-level error handling cannot catch it.

Attack scenarios

The issue is reachable through ordinary metadata parsing of attacker-controlled Matroska/WebM files. Reported proofs of concept exercised string, unsigned-integer, binary, and UID leaves. Depending on the tokenizer and runtime, affected entry points include parseBuffer, parseFile, parseStream, parseBlob, and parseWebStream.

One minimal buffer-based proof of concept uses a docType string with an oversized eight-byte VINT:

import { parseBuffer } from 'music-metadata';

const payload = Uint8Array.from([
  0x1a, 0x45, 0xdf, 0xa3, 0x8a,
  0x42, 0x82,
  0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
]);

await parseBuffer(payload, { mimeType: 'video/webm' });

Another proof of concept used a valid WebM EBML header followed by an ebmlReadVersion leaf whose VINT declared 0x800000000 bytes (32 GiB), while supplying only one payload byte. Through parseFile, this reached the fatal V8 abort described above.

Fix

PR #2735 validates EBML leaf lengths before decoding or allocating. It rejects lengths that are unsafe, exceed the enclosing container, or exceed the known remaining file data. For streams whose total size is unknown, large leaves are read incrementally so truncated input fails before one large allocation is attempted. Nested-container boundaries are also constrained by ancestor and file boundaries.

At the time this advisory was updated, PR #2735 was still open and no patched release had been published.

Credits

This advisory consolidates independent reports of the same EBML length-validation flaw:

@bg0d-glitch reported oversized VINT lengths reaching string and binary allocation paths.
@Zwique demonstrated approximately 128 MiB of allocation from a 34-byte EBML input as part of a broader parser review.
@offset demonstrated a 500 MiB allocation from a 70-byte binary-leaf input and the effect of concurrent parses.
@arpitjain099 demonstrated the 48-byte parseFile case that triggers an uncatchable V8 fatal abort.

The reports were consolidated because they share the same vulnerable component, missing validation, allocation sinks, and fix.

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "music-metadata"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107389"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T19:43:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Matroska/WebM EBML parser decodes attacker-controlled variable-length integer (VINT) element lengths without first validating that the declared element fits within its enclosing container or the available input. Leaf lengths are then used directly for string-token and `Uint8Array` allocations.\n\nA very small crafted `.webm`, `.mkv`, or `.mka` file can therefore cause a disproportionately large allocation, an out-of-memory denial of service, or\u2014in one demonstrated `parseFile` case\u2014an uncatchable V8 fatal abort.\n\n## Impact\n\nApplications that parse untrusted Matroska/WebM media can be denied service. Depending on the input, parser API, and Node.js/V8 version, the demonstrated outcomes include:\n\n- a 34-byte input causing an approximately 128 MiB allocation before end-of-input;\n- a 70-byte input causing a 500 MiB allocation through a binary EBML leaf, with concurrent parses multiplying memory consumption;\n- a 48-byte file causing an uncatchable V8 fatal abort through `parseFile` when a leaf declares a length of 32 GiB.\n\nThe fatal-abort case was reproduced on `music-metadata` 11.15.0 with Node.js 26.7.0. It was deterministic across three runs and exited with code 133 despite a surrounding `try`/`catch`. The same reporter did not reproduce that fatal abort through `parseBuffer` on Node.js 20 through 25; those configurations can still encounter allocation attempts or catchable errors. The exact failure mode is therefore runtime- and tokenizer-dependent, but the underlying validation flaw is shared.\n\nThe impact is limited to availability; no confidentiality or integrity impact has been demonstrated.\n\n## Root cause\n\n`EbmlIterator.readElement()` decodes an element length from an EBML VINT and converts it to a JavaScript `Number`:\n\n```ts\nprivate async readElement(): Promise\u003cIHeader\u003e {\n  const id = await this.readVintData(this.ebmlMaxIDLength);\n  const lenField = await this.readVintData(this.ebmlMaxSizeLength);\n  lenField[0] ^= 0x80 \u003e\u003e (lenField.length - 1);\n  return {\n    id: readUIntBE(id, id.length),\n    len: readUIntBE(lenField, lenField.length)\n  };\n}\n```\n\nBefore the fix, that value was not checked against the parent boundary or known file size before reaching the leaf readers:\n\n```ts\nprivate async readString(e: IHeader): Promise\u003cstring\u003e {\n  const rawString = await this.tokenizer.readToken(new StringType(e.len, \u0027utf-8\u0027));\n  return rawString.replace(/\\x00.*$/g, \u0027\u0027);\n}\n\nprivate async readBuffer(e: IHeader): Promise\u003cUint8Array\u003e {\n  const buf = new Uint8Array(e.len);\n  await this.tokenizer.readBuffer(buf);\n  return buf;\n}\n```\n\nAn EBML size VINT can encode values approaching 2^56. A crafted file can select a known string, unsigned-integer, binary, or UID element and route its declared size into an allocation before the tokenizer discovers that the input is truncated. The declared length also participates in container-boundary arithmetic.\n\nFor lengths around 32 GiB, one reporter observed V8 aborting on its external-memory accounting check:\n\n```text\nFatal error: Check failed: change_in_bytes \u003c kMaxReasonableBytes\nprocess exit code 133\n```\n\nThis is a V8 process abort rather than a JavaScript exception, so application-level error handling cannot catch it.\n\n## Attack scenarios\n\nThe issue is reachable through ordinary metadata parsing of attacker-controlled Matroska/WebM files. Reported proofs of concept exercised string, unsigned-integer, binary, and UID leaves. Depending on the tokenizer and runtime, affected entry points include `parseBuffer`, `parseFile`, `parseStream`, `parseBlob`, and `parseWebStream`.\n\nOne minimal buffer-based proof of concept uses a `docType` string with an oversized eight-byte VINT:\n\n```js\nimport { parseBuffer } from \u0027music-metadata\u0027;\n\nconst payload = Uint8Array.from([\n  0x1a, 0x45, 0xdf, 0xa3, 0x8a,\n  0x42, 0x82,\n  0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff\n]);\n\nawait parseBuffer(payload, { mimeType: \u0027video/webm\u0027 });\n```\n\nAnother proof of concept used a valid WebM EBML header followed by an `ebmlReadVersion` leaf whose VINT declared `0x800000000` bytes (32 GiB), while supplying only one payload byte. Through `parseFile`, this reached the fatal V8 abort described above.\n\n## Fix\n\n[PR #2735](https://github.com/Borewit/music-metadata/pull/2735) validates EBML leaf lengths before decoding or allocating. It rejects lengths that are unsafe, exceed the enclosing container, or exceed the known remaining file data. For streams whose total size is unknown, large leaves are read incrementally so truncated input fails before one large allocation is attempted. Nested-container boundaries are also constrained by ancestor and file boundaries.\n\nAt the time this advisory was updated, PR #2735 was still open and no patched release had been published.\n\n## Credits\n\nThis advisory consolidates independent reports of the same EBML length-validation flaw:\n\n- [@bg0d-glitch](https://github.com/bg0d-glitch) reported oversized VINT lengths reaching string and binary allocation paths.\n- [@Zwique](https://github.com/Zwique) demonstrated approximately 128 MiB of allocation from a 34-byte EBML input as part of a broader parser review.\n- [@offset](https://github.com/offset) demonstrated a 500 MiB allocation from a 70-byte binary-leaf input and the effect of concurrent parses.\n- [@arpitjain099](https://github.com/arpitjain099) demonstrated the 48-byte `parseFile` case that triggers an uncatchable V8 fatal abort.\n\nThe reports were consolidated because they share the same vulnerable component, missing validation, allocation sinks, and fix.",
  "id": "GHSA-5gfj-9q3v-qfp3",
  "modified": "2026-10-08T19:43:09Z",
  "published": "2026-10-08T19:43:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-5gfj-9q3v-qfp3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Borewit/music-metadata/pull/2735"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Borewit/music-metadata/commit/163f013364ac9fc8dd0c3987433cd065a615af58"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Borewit/music-metadata/commit/2d14dc1f7391a94235948a0b823155538f69b3df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Borewit/music-metadata"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Borewit/music-metadata/releases/tag/v11.16.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107389 (GCVE-0-2026-107389)

FKIE_CVE-2026-107389

GHSA-5GFJ-9Q3V-QFP3

Summary

Impact

Root cause

Attack scenarios

Fix

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour