music-metadata: EBML VINT length trusted, allowing memory exhaustion (CVE-2026-107389)

What happened

The music-metadata EBML/WebM parser decodes an attacker-controlled VINT element length and uses that value to allocate string tokens or Uint8Array buffers before confirming the decoded leaf fits within its parent element or the available input. Crafted WebM, MKV, or MKA files can therefore trigger disproportionate allocations and out-of-memory denial-of-service. In addition, an uncatchable fatal abort was observed on a demonstrated parseFile path running on runtime 26.7.0. The flaw affects availability only and does not affect confidentiality or integrity according to the available reports. (source items: 4112, 31906)

Technical cause

The parser trusts a decoded VINT element length and uses it directly for string-token or Uint8Array allocation before validating that the leaf fits inside its parent element or the remaining input. This missing leaf-length validation across the tokenizer and parser allows crafted inputs to force excessive allocations or to trigger a fatal runtime abort in some environments. (source items: 4112, 31906)

Why it matters

The vulnerability has an availability impact only: attackers can cause memory exhaustion or crash the process when parsing specially crafted EBML-based media files. The assigned CVSS v3.1 base score is 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting local attack vector with high impact to availability but no confidentiality or integrity loss. The PatchWire urgency score for this advisory is 3.6, derived primarily from the CVSS base score and the fact that no user interaction is required to trigger the issue. (source items: 4112, 31906)

Who is affected

Projects and systems that use the music-metadata package to parse Matroska/WebM EBML content (for example MKV, MKA, or WebM files) and that run a vulnerable release of music-metadata may be affected. Attackers able to supply crafted media files to the parsing context can trigger the issue. (source items: 4112, 31906)

Discovery and timeline

The vulnerability was published in OSV.dev on 2026-10-08 and is listed in the NVD entry for CVE-2026-107389 on 2026-10-08. The OSV entry and the NVD record provide the details used in this briefing. (source items: 4112, 31906)

Affected versions

All releases of music-metadata from introduced version 0 up to, but not including, 11.16.0 are affected. (source items: 4112)

Fixes and mitigation

The issue is fixed in music-metadata version 11.16.0. Users should update to 11.16.0. If an immediate upgrade is not possible, consider parsing untrusted EBML-based media in a restricted environment (separate process with memory limits) or pre-validating container structure before handing data to the vulnerable parser. (source items: 4112)

Recommended action

Upgrade music-metadata to 11.16.0 as soon as practicable. Treat untrusted EBML-based media (WebM, MKV, MKA) as potentially malformed and avoid parsing it in high-privilege or unrestricted-memory processes. (source items: 4112)