Quick answers
- Is CVE-2026-107390 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107390 being exploited in the wild.
- How severe is CVE-2026-107390?
- Medium severity, with a CVSS score of 6.2, published 8 October 2026.
- Which products and versions are affected?
- Borewit Music-Metadata prior to 11.16.0.
- Is there a fix for CVE-2026-107390?
- Yes: fixed in 11.16.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107390 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-107390?
- Check whether you run Borewit Music-Metadata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 11.16.0
Technical details
The MP4 parser converts attacker-controlled 64-bit extended atom sizes to JavaScript Numbers without validating they fit within parent atoms or available input, and uses the resulting payload length for readToken calls before bounds checking. This allows an oversized length to route into payload parsing for atoms such as mvhd, stsd, stsz, and date, triggering large allocation attempts or process failure. The fix validates atom header sizes, safe integer limits, and file/parent boundaries before dispatch.
Affected products
- Borewit music-metadata prior to 11.16.0
Timeline
- 2026-10-08: disclosed
- 2026-09-22: patched