# CVE-2026-107390: music-metadata MP4 parser integer overflow in atom size parsing

Source: https://junglewise.ai/threats/cve-2026-107390-music-metadata-is-a-metadata-parser-for-audio-and-video-media  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107390 · Severity: medium · CVSS 6.2 · Published 2026-10-08

music-metadata is a library that extracts metadata from audio and video files. An attacker can craft a malicious MP4 file with a specially crafted 64-bit atom size value that causes the parser to attempt massive memory allocations or crash, denying service to applications that process untrusted media files.

Technologies: [Borewit Music-Metadata](https://junglewise.ai/threats/technologies/borewit-music-metadata). Vendors: [Borewit](https://junglewise.ai/threats/vendors/borewit).

## Quick answers

**Is CVE-2026-107390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107390 being exploited in the wild.

**How severe is CVE-2026-107390?** Medium severity, with a CVSS score of 6.2, published 8 October 2026.

**Which products and versions are affected?** Borewit Music-Metadata prior to 11.16.0.

**Is there a fix for CVE-2026-107390?** Yes: fixed in 11.16.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107390 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107390?** Check whether you run Borewit Music-Metadata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.16.0

## Technical details

The MP4 parser converts attacker-controlled 64-bit extended atom sizes to JavaScript Numbers without validating they fit within parent atoms or available input, and uses the resulting payload length for readToken calls before bounds checking. This allows an oversized length to route into payload parsing for atoms such as mvhd, stsd, stsz, and date, triggering large allocation attempts or process failure. The fix validates atom header sizes, safe integer limits, and file/parent boundaries before dispatch.

## Affected products

- Borewit music-metadata prior to 11.16.0

## Timeline

- 2026-10-08: disclosed
- 2026-09-22: patched

## References

- [https://github.com/Borewit/music-metadata/commit/0f19ad66d71889b1c5f3ba84d4824f079ac4c005](https://github.com/Borewit/music-metadata/commit/0f19ad66d71889b1c5f3ba84d4824f079ac4c005)
- [https://github.com/Borewit/music-metadata/pull/2746](https://github.com/Borewit/music-metadata/pull/2746)

## Related threats

- [music-metadata uncatchable process crash parsing DSF files](https://junglewise.ai/threats/cve-2026-107392-music-metadata-uncatchable-process-crash-parsing-a-crafted-dsf)
- [music-metadata MP4 stsd infinite loop denial of service](https://junglewise.ai/threats/cve-2026-107391-music-metadata-mp4-stsd-sample-entry-size-0-causes-a-synchronous)
- [music-metadata EBML parser memory exhaustion](https://junglewise.ai/threats/cve-2026-107389-music-metadata-ebml-parser-trusts-element-lengths-allowing)
- [music-metadata ID3v2 tag buffer allocation DoS](https://junglewise.ai/threats/cve-2026-107388-music-metadata-id3v2-tag-size-not-validated-before-allocation)
- [music-metadata uncontrolled memory allocation in APEv2 parser](https://junglewise.ai/threats/cve-2026-107387-music-metadata-uncontrolled-memory-allocation-in-apev2-parser)