TI-2026-74650 Aliases CVE-2026-104266 GHSA-24cc-9352-h2pg

Infinite loop in tinytag Python library parsing M4A files

LOW 29CWE-835Published 2026-10-15 · Updated 2026-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

tinytag, a Python library for reading audio file metadata, is affected from 2.0.0 before 2.3.0. A sub-atom with a size of zero inside a custom field atom in an M4A file stops the metadata parser from advancing, which causes an infinite loop (CWE-835). An attacker who supplies a crafted M4A file can deny service to a program that reads it, and user interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00332 26th percentileScored 2026-11-07

Fix Partial tinytag (tinytag): 2.3.0tinytag (PyPI): 2.3.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tinytag	tinytag	2.0.0 to before 2.3.0	2.3.0	Patch available	CNA
—	tinytag (PyPI)	2.0.0 to before 2.3.0	2.3.0	Patch available	GHSA-24cc-9352-h2pg

tinytag Vendortinytag Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
tinytag (PyPI) Vendor— Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-24cc-9352-h2pg

Remediation

Upgrade the tinytag package on PyPI to version 2.3.0, which fixes the issue. Red Hat lists Lightspeed Core and OpenShift Lightspeed as affected without a fix and has no fix plan available for them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA tinytag (tinytag) Fixed in 2.3.0
Fix · GHSA-24cc-9352-h2pg tinytag (PyPI) Fixed in 2.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Lightspeed Core	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred

Timeline

2026-10-16 Threatist record created from CVE-2026-104266
2026-10-16 Alias added: GHSA-24cc-9352-h2pg
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-21 CISA SSVC decision points changed

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-104266

Other 5

TI-2026-25348 tinytag: Denial of Service via non-terminating SYLT frame parsing loop CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences