All vulnerabilities
CVE-2026-104266GHSA-24cc-9352-h2pg

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

tinytag tinytagpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.3.0Fixed versionGitHub
Published15 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 2.3.0tinytag, pipGitHub
  • 2.3.0tinytag, PyPIOSVpip install "tinytag>=2.3.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An M4A file containing a sub-atom with a size of zero in the ---- atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.

Patches

The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.

Workarounds

No workarounds exist. Users must upgrade to tinytag 2.3.0.

Text from GitHub Advisory Database

Affected versions 9

  • tinytag, pip>= 2.0.0, < 2.3.0GitHub
  • tinytagaffected: >= 2.0.0, < 2.3.0CVE List
  • tinytag, PyPIfrom 2.0.0, fixed in 2.3.0OSV
  • tinytag, PyPI2.0.0OSV
  • tinytag, PyPI2.1.0OSV
  • tinytag, PyPI2.1.1OSV
  • tinytag, PyPI2.1.2OSV
  • tinytag, PyPI2.2.0OSV
  • tinytag, PyPI2.2.1OSV

References 6