music-metadata EBML Parser Memory Exhaustion DoS via Unvalidated VINT Length CVE-2026-107389

Vulnerability Overview Vulnerability Name: EBML parser trusts element lengths, allowing memory exhaustion or process abort Description: The Matroska/WebM EBML parser does not verify whether a claimed element length fits within its containing container or available input before decoding attacker-controlled Variable-Length Integer (VINT) element lengths. The leaf length is then used directly for string token and allocation. Severity: Medium (6.2 / 10) CVE ID: CVE-2026-107389 CVSS v3 Base Metrics: Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High Impact Scope Affected Version: 11.12.3 Fixed Version: 11.16.0 Specific Impacts: A 54-byte file can cause an allocation of approximately 128 MB before input exhaustion. A 70-byte file can lead to 500 MB allocated via binary EBML leaf allocation, with memory consumption doubling under concurrent parsing. A 48-byte file can cause an uncatchable V8 fatal error when the leaf declares a length of 32 GB. Fatal Error: On Node.js 26.7.0, the fatal error is reproducible in 11.15.0. It is deterministic across three runs, exiting with code 133, despite being wrapped in . The same reporter did not reproduce this fatal error on running on Node.js 20 through 25; those configurations may still encounter allocation attempts or catchable errors. Remediation PR #2735: Validates EBML leaf lengths before decoding or allocation. It rejects unsafe lengths that exceed container boundaries or known remaining file data. For streams with unknown total size, large leaves are read incrementally until truncation of the input fails, after which a large allocation is attempted. Nested container boundaries are also constrained by ancestor and file boundaries. Fixed Code: Code Before Fix: Code After Fix: Additional Exploit Code: Summary This vulnerability allows for denial of service by parsing untrusted Matroska/WebM media. The remediation includes validating EBML leaf lengths to ensure they do not exceed container boundaries or known file data.

Goal Reached Thanks to every supporter — we hit 100%!

music-metadata EBML Parser Memory Exhaustion DoS via Unvalidated VINT Length CVE-2026-107389

More from this source