CVE-2026-104266: 
Python vulnerability analysis and mitigation

CVE-2026-104266 is a denial-of-service vulnerability in tinytag, a Python library for reading audio file metadata. Affecting versions 2.0.0 through 2.3.0 (exclusive), the flaw allows a crafted M4A file containing a sub-atom with a size of zero inside a ---- (custom field) atom to cause the metadata parser to enter an infinite loop, halting any program that processes the file. The vulnerability was reported by seankohjs, disclosed on October 15, 2026, and fixed in tinytag 2.3.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). In the vulnerable _parse_custom_field method, the code iterates over sub-atoms within a ---- atom by reading an 8-byte header and computing the next position by subtracting the header length from the atom size. When a sub-atom declares a size of zero, the computed advance is negative or zero, so the file handle never moves forward, and the loop condition is never satisfied. The fix in PR #326 refactored atom parsing to use a unified _read_atom_header() helper that explicitly validates atom sizes and returns None for invalid (zero or undersized) atoms, terminating the loop safely. Exploitation requires user interaction — a victim application or user must open or process the malicious M4A file (GitHub Advisory, Patch Commit).

Successful exploitation causes the affected application to hang indefinitely while processing the malicious M4A file, resulting in a complete denial of service for the parsing process. There is no impact on confidentiality or data integrity — only availability is affected. Applications that process user-supplied audio files (e.g., media servers, music players, or metadata indexers using tinytag) are at risk of becoming unresponsive or requiring manual intervention to recover (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to supply a crafted M4A file to a target application using a vulnerable version of tinytag, which necessitates user interaction (GitHub Advisory, Red Hat CVE).

1. Craft malicious M4A file: Create an M4A file containing a ---- (custom field) atom with at least one sub-atom whose size field is set to zero. This can be done with a hex editor or a custom script that constructs the binary atom structure manually.
2. Deliver the file to the target: Distribute the crafted M4A file to a system or service that uses tinytag (versions 2.0.0–2.2.x) to parse audio metadata — for example, by uploading it to a media server, sharing it via a file-sharing platform, or sending it to a user who will open it with an affected application.
3. Trigger parsing: The target application calls tinytag to read the file's metadata (e.g., TinyTag.get('malicious.m4a')).
4. Infinite loop triggered: The _parse_custom_field method reads the zero-size sub-atom header, computes a zero or negative advance, and loops indefinitely without making progress through the file, consuming 100% CPU and hanging the process.
5. Denial of service achieved: The application becomes unresponsive for the duration of the loop, requiring a process kill or restart to recover (GitHub Advisory, Patch Commit).

• Process: A Python process running an application that uses tinytag consuming 100% CPU for an extended or indefinite period while processing an M4A file.
• File System: Presence of an unexpected or externally supplied M4A file with a malformed ---- atom (zero-size sub-atom); test sample files named mp4_invalid_size_zero.m4a or empty_custom_field.m4a may indicate testing activity.
• Logs: Application logs showing a metadata parsing call that never completes or times out when processing a specific M4A file; absence of a return value or exception from TinyTag.get() for a given file.
• Network: Unusual upload of M4A files to services that perform server-side metadata extraction using tinytag, particularly files that are structurally minimal but trigger high CPU usage.

The only remediation is to upgrade tinytag to version 2.3.0 or later, which fixes the infinite loop by refactoring atom parsing to use a unified header-reading function with proper size validation. No workarounds exist for vulnerable versions. As a defense-in-depth measure, operators should consider running metadata parsing in isolated processes with CPU time limits or timeouts to contain the impact of any denial-of-service attempt (GitHub Advisory, Release 2.3.0).