GitHub Advisoryadvisory · PyPI
GHSA-24cc-9352-h2pg tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
MEDIUM
Official page ↗
- Aliases
- CVE-2026-104266
- Ecosystem
- PyPI
- Packages
- tinytag
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-835
- Reviewed
- 2026-10-15
Affected packages
• PyPI tinytag: >= 2.0.0, < 2.3.0 → fixed in 2.3.0
Description
Impact
An M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
Patches
The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.
Workarounds
No workarounds exist. Users must upgrade to tinytag 2.3.0.
Related
Alias · CVE (1)
- CVE-2026-104266 tinytag is a Python library for reading audio file metadata. vulnerability
Weakness · CWE (1)
- CWE-835 Loop with Unreachable Exit Condition weakness
References
- https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg web
- https://nvd.nist.gov/vuln/detail/CVE-2026-104266 advisory
- https://github.com/tinytag/tinytag/pull/326 web
- https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e web
- https://github.com/tinytag/tinytag package
- https://github.com/tinytag/tinytag/releases/tag/2.3.0 web