CVE-2026-104266 Details
Description
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.
A denial-of-service vulnerability has been identified in the tinytag Python library, specifically in versions 2.0.0 prior to 2.3.0. The issue arises when an M4A file contains a sub-atom with a size of zero within a certain atom, leading the metadata parser into an infinite loop. This loop prevents the parser from progressing through the file, causing programs that read the affected file to hang indefinitely.
Users are advised to upgrade to tinytag version 2.3.0 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e | [email protected] | Source CodeVendor |
| https://github.com/tinytag/tinytag/pull/326 | [email protected] | Source CodeVendor |
| https://github.com/tinytag/tinytag/releases/tag/2.3.0 | [email protected] | Release NotesVendor |
| https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tinytag | >= 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |