CVE-2026-104266 with a CVSS score of 6.5 is a denial-of-service vulnerability in the tinytag audio metadata parser, affecting tinytag (pip) versions >= 2.0.0, < 2.3.0. The flaw occurs when tinytag processes an M4A file that contains an invalid atom structure, specifically a sub-atom with a size of zero inside the ---- atom. During parsing, the library can enter an infinite loop instead of handling the malformed atom safely, causing the consuming program to hang or become unresponsive. An attacker can exploit the issue by causing a vulnerable application to read a crafted M4A file, for example through a network-delivered file that a user opens or an application processes. The attack does not require authentication or elevated privileges, but it does require user interaction or application processing of the malicious file. The primary business impact is loss of availability: services, media-processing pipelines, file-handling endpoints, or batch jobs that rely on tinytag may become stuck, consume excessive CPU, and fail to complete work, potentially disrupting operations and increasing support or recovery costs.
We recommend you to update tinytag to version 2.3.0.[/subscribe_to_unlock_form]
CVE-2026-104266 with a CVSS score of 6.5 is a denial-of-service vulnerability in the tinytag audio metadata parser, affecting tinytag (pip) versions >= 2.0.0, < 2.3.0. The flaw occurs when tinytag processes an M4A file that contains an invalid atom structure, specifically a sub-atom with a size of zero inside the ---- atom. During parsing, the library can enter an infinite loop instead of handling the malformed atom safely, causing the consuming program to hang or become unresponsive. An attacker can exploit the issue by causing a vulnerable application to read a crafted M4A file, for example through a network-delivered file that a user opens or an application processes. The attack does not require authentication or elevated privileges, but it does require user interaction or application processing of the malicious file. The primary business impact is loss of availability: services, media-processing pipelines, file-handling endpoints, or batch jobs that rely on tinytag may become stuck, consume excessive CPU, and fail to complete work, potentially disrupting operations and increasing support or recovery costs.
We recommend you to update tinytag to version 2.3.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]