[ Vendor · 6 CVEs ]
Borewit
CVEs affecting Borewit published in the last 30 days, plus any Borewit CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107389 | 8 Oct 2026 | CVSS 5.5 | music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortmusic-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an… | Fix |
| CVE-2026-107390 | 8 Oct 2026 | CVSS 7.5 | Borewit music-metadatamusic-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended… | Fix |
| CVE-2026-107391 | 8 Oct 2026 | CVSS 7.5 | music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on mastermusic-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a… | Fix |
| CVE-2026-107392 | 8 Oct 2026 | CVSS 7.5 | music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling… | Fix |
| CVE-2026-107387 | 8 Oct 2026 | CVSS 5.5 | music-metadata: Uncontrolled memory allocation in APEv2 parsermusic-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size… | Fix |
| CVE-2026-107388 | 8 Oct 2026 | CVSS 5.5 | music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSmusic-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and… | Fix |