Vulnerability GHSA-24cc-9352-h2pg
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 hours ago
October 15, 2026 at 08:16 PM UTC
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
2.0.0 - 2.2.1
2.0.0 - 2.2.1
Summary
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
Details
Impact
An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
Patches
The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.
Workarounds
No workarounds exist. Users must upgrade to tinytag 2.3.0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Denial of service via non-terminating SYLT frame parsing loop in tinytag
0.6.0 - 2.2.0 PYSEC-2026-3386
0.6.0 - 2.2.0 PYSEC-2026-3386
Medium Risk
7 months ago
Denial of service via non-terminating SYLT frame parsing loop in tinytag
0.6.0 - 2.2.0 GHSA-f4rq-2259-hv29
0.6.0 - 2.2.0 GHSA-f4rq-2259-hv29
Impacted packages
Timeline
Published
5 hours ago
October 15, 2026 at 08:16 PM UTC
Fixed (2.3.0)
2 months ago
July 30, 2026 at 11:35 PM UTC
Last Modified
5 hours ago
October 15, 2026 at 08:30 PM UTC