CVE-2026-107391 — music-metadata: MP4 stsd sample-entry size==0 can cause synchronous infinite loop (DoS)

What happened

A development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent advancement of the parser cursor while an attacker-controlled entry_count keeps a synchronous loop running. A crafted MP4-family input can therefore block the process event loop and cause the sample-description table to grow until the process is terminated or exhausts memory. The issue is tracked as CVE-2026-107391 (GHSA-f94x-6692-553q). [4115,31908]

Technical cause

The parser's StsdAtom.get cursor does not advance when given a sample-entry size of zero; combined with an attacker-controlled entry_count this keeps a synchronous loop from terminating. This regression arose in a public development revision after 11.14.0. The underlying weakness maps to resource exhaustion (CWE-400). [4115,31908]

Why it matters

A crafted MP4-family file can trigger an infinite synchronous loop in the parser, blocking the process event loop and growing in-memory data structures until the process is terminated or runs out of memory. This results in a denial-of-service condition for any application that parses untrusted MP4-family inputs with the vulnerable code path. [4115,31908]

Who is affected

The change that introduced the regression was present on the public master (development) branch after 11.14.0 but was not included in the music-metadata 11.14.0 release or any earlier release. The OSV record lists the affected range as introduced at 0 and fixed at 11.16.0. Consumers using the vulnerable development revision or any release earlier than 11.16.0 should consider themselves at risk. [4115,31908]

Discovery and timeline

Public records for this issue were published on 2026-10-08 (OSV) and 2026-10-08/2026-10-09 in the NVD entry. The package advisory metadata shows published_at 2026-10-08T19:43:25+02:00 and modified_at 2026-10-09T16:17:22+02:00. The fact package does not provide details about the original reporter, the exact commit, or any intervening changes beyond the stated version range. [4115,31908]

Affected versions

According to the advisory claims, the issue was introduced at version "0" and fixed in "11.16.0". The advisory also notes the regression was introduced after "11.14.0" and not present in "11.14.0" or earlier releases. [4115]

Fixes and mitigation

A fixed release is available: music-metadata version "11.16.0" contains the fix. The advisory indicates fix_available = true and includes a fixed_version claim for "11.16.0". [4115,31908]

Recommended action

Update deployments to music-metadata "11.16.0". Avoid using the vulnerable public development/master revision described in the advisory. Verify that components which parse MP4-family inputs are running the fixed release. [4115]