tinytag: Infinite loop when parsing certain M4A files containing invalid atoms (CVE-2026-104266)
Description
tinytag versions 2.0.0 up to but not including 2.3.0 contain a vulnerability where parsing certain crafted M4A files with a zero-sized sub-atom in the `----` atom causes an infinite loop. This results in a denial-of-service condition for applications using tinytag to read such files. The issue is fixed in version 2.3.0. No workarounds exist other than upgrading.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The tinytag library has a vulnerability (CVE-2026-104266) in versions >=2.0.0 <2.3.0 where an M4A file containing a sub-atom with a size of zero inside the `----` atom causes the parser to enter an infinite loop. This infinite loop leads to a denial-of-service (DoS) condition for programs processing these files. The root cause is insufficient size checks during atom parsing. The issue was resolved in tinytag 2.3.0 by reusing the primary atom parsing code path that includes proper size validation.
Potential Impact
Denial-of-service (DoS) occurs when the vulnerable tinytag parser processes a maliciously crafted M4A file with a zero-sized sub-atom, causing an infinite loop and application hang or crash. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade tinytag to version 2.3.0 or later, where the vulnerability is fixed. No other workarounds are available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-24cc-9352-h2pg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-104266"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ad14e912cdf04f65660b0ab
Added to database: 10/15/2026, 22:07:13 UTC
Last enriched: 10/15/2026, 22:09:12 UTC
Last updated: 10/15/2026, 22:09:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.