CVE-2026-104266: tinytag Infinite Loop Vulnerability in M4A File Parsing
Summary
CVE-2026-104266: tinytag: Infinite loop when parsing certain M4A files containing invalid atoms. Affects tinytag versions >= 2.0.0, < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tinytag is a lightweight Python library used for reading audio metadata from various audio file formats, including MP3, M4A, and others. It is designed to be simple and efficient, allowing developers to easily extract information such as title, artist, album, and duration from audio files. However, tinytag is vulnerable to a specific issue when parsing M4A files that contain invalid atoms, which can lead to severe performance issues.
Vulnerability Detail
The vulnerability arises from the parsing of M4A files that contain a sub-atom with a size of zero in the '----' atom. This flaw causes the parser to enter an infinite loop, leading to a denial-of-service condition for any program attempting to read such files using tinytag. This can result in applications freezing or crashing, severely impacting user experience and application reliability.
How To Fix
Latest published version: 2.3.2 as of 23 Oct 2026
pip install --upgrade "tinytag==2.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
pip install --upgrade "tinytag==2.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workarounds are available for this vulnerability. The only solution is to upgrade to the patched version of tinytag.
Conclusion
In summary, the tinytag library has a vulnerability that can lead to an infinite loop when parsing certain M4A files, resulting in denial-of-service conditions. Users are advised to upgrade to version 2.3.0 or later to mitigate this risk. Regular monitoring for vulnerabilities can be facilitated using tools like Vulert.
See every vulnerability recorded for tinytag →
FAQ
The vulnerability can cause applications using tinytag to enter an infinite loop when processing certain M4A files, leading to denial-of-service conditions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
Yes, the vulnerability has been fixed in tinytag version 2.3.0. Users should upgrade to this version to mitigate the risk.
Since there are no workarounds available, it is highly recommended to prioritize upgrading to the patched version as soon as possible to avoid potential denial-of-service issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinytag.
