CVE-2026-32889

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32889
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32889.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32889
Aliases
Published
2026-03-20T02:23:25Z
Modified
2026-08-12T03:51:38Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
tinytag: Denial of Service via non-terminating SYLT frame parsing loop
Details

tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating loop while the library parses an ID3v2 SYLT (synchronized lyrics) frame. In server-side deployments that automatically parse attacker-supplied files, a single 498-byte MP3 can cause the parsing operation to stop making progress and remain busy until the worker or process is terminated. The root cause is that _parse_synced_lyrics assumes _find_string_end_pos always returns a position greater than the current offset. That assumption is false when no string terminator is present in the remaining frame content. This issue has been fixed in version 2.2.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32889.json"
}
References

Affected packages

Git / github.com/tinytag/tinytag

Affected ranges

Type
GIT
Repo
https://github.com/tinytag/tinytag
Events
Introduced
6f1d3060f393743c2ec34d07c0855cceed827244
Fixed
7bd4e392cc6696430d19535546b991906fec59d0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*
2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32889.json"