~ / search / GHSA-24cc-9352-h2pg

GHSA-24cc-9352-h2pg

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-104266

Packages

EcosystemPackageAffectedFixed in
PyPI tinytag >= 2.0.0, < 2.3.0 2.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag. ### Patches The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks. ### Workarounds No workarounds exist. Users must upgrade to tinytag 2.3.0.

References

External links from the advisory. They lead to third-party sites.