Executive brief
Symphonia is a multimedia library used for decoding audio and reading metadata tags. A vulnerability in how it handles audio file metadata allows a specially crafted file to crash the application by exhausting system memory. This could lead to a denial-of-service, impacting the availability of any software using this library to process untrusted audio files.
Technical details
A vulnerability classified as CWE-404 (Improper Resource Shutdown or Release) exists in the Metadata Handler component of pdeljanov Symphonia up to version 0.6.0. The root cause is a lack of bounds checking on 32-bit length prefixes read from attacker-controlled input in Vorbis, FLAC, and ID3v2 metadata parsers. An attacker can provide a malformed audio file with a large length prefix (up to 4 GiB), causing the library to attempt a massive memory allocation (OOM), leading to a process crash. While the attack requires the local ability to provide a file to the decoder, it can be triggered via standard entry points like rodio::Decoder::new. A pull request (PR #514) has been submitted to implement a 16MiB maximum metadata block size limit.
Affected products
- pdeljanov Symphonia up to 0.6.0
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub repository
- 2026-06-10: other: Fix pull request submitted
- 2026-07-09: advisory: CVE published and VulDB entry created