CVE-2026-32889 Details

A denial-of-service vulnerability has been identified in the tinytag Python library, specifically in version 2.2.0. This issue arises when the library parses MP3 files containing ID3v2 SYLT (synchronized lyrics) frames. The vulnerability allows an attacker to create a malicious MP3 file that, when processed by tinytag, triggers an infinite loop in the parsing function. This loop continues indefinitely until the active process or worker is manually terminated. The problem stems from an incorrect assumption in the parsing logic, where the absence of a string terminator in the SYLT frame content leads to a reset of the parsing offset, causing the loop to stall. In server-side applications that automatically handle user-uploaded files, this vulnerability can be exploited with a single 498-byte MP3 file, effectively freezing the parsing operation and disrupting normal workflow.

Users can upgrade to tinytag version 2.2.1, which addresses this vulnerability by ensuring that the string end position function correctly handles cases without a terminator, preventing the infinite loop in SYLT frame parsing.