MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-104266
### Impact An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag. ### Patches The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks. ### Workarounds No workarounds exist. Users must upgrade to tinytag 2.3.0.
Properties
- Severity
- medium
- Summary
- tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00252
- Cvss score
- 6.5
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Ghsa published
- 2026-10-15T20:16:47Z
- Source url
- https://github.com/advisories/GHSA-24cc-9352-h2pg
- Ghsa updated
- 2026-10-15T20:16:48Z
- Ghsa id
- GHSA-24cc-9352-h2pg
- Last source
- FIRST EPSS
- Score
- 6.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-104266
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- First seen by Signal
- 2026-10-15T22:56:51+00:00
- Is ghsa only
- false
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Published at
- 2026-10-15T18:17:22.983
Related Entities (3)
AFFECTS (1)
HAS_WEAKNESS (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph