cyfenced.com →

[ CVE-2026-104266 · Published 15 Oct 2026 ]

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

CVSS 6.5 EPSS <1%Fix available

[ Description ]Official description

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

[ Fixes ]Fixes and patches

  • tinytag 2.3.0Fixed version · GitHub Advisories · pip package tinytag: upgrade to 2.3.0 or later (affected >= 2.0.0, < 2.3.0)

[ Packages ]Affected open-source packages

[ References ]References