7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32256

CVE-2026-32256: music-metadata has an infinite loop vulnerability in ASF parser

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (parseExtensionObject() in lib/asf/AsfParser.ts:112-158) enters an infinite loop when a sub-object inside the ASF Header Extension Object has objectSize = 0. Version 11.12.3 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32256

CVE-2026-32256:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
music-metadata	npm	<= 11.12.1	11.12.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an infinite loop in the ASF parser of the music-metadata library, identified as CVE-2026-32256. The root cause is the improper handling of object sizes within the AsfParser.parseObjectHeader function in lib/asf/AsfParser.ts. When parsing a crafted ASF file containing an object with a size of 0, the code calculates a negative remaining size. This negative value leads to incorrect pointer arithmetic, causing the parser to get stuck in an infinite loop, rereading the same data. This results in a denial of service.

The patch addresses this by adding a crucial validation step. It checks if the calculated remaining size is negative and, if so, throws an error, preventing the infinite loop. The analysis of the commit 318e963e21734bc03b4c7811facb23f900f9a378 confirms this change.

The primary vulnerable function is AsfParser.parseObjectHeader. However, the publicly exposed and affected methods are parseFile and parseBuffer, which are the entry points for this vulnerability. Any application using these functions to parse untrusted ASF files is at risk.

Vulnerable functions

AsfParser.parseObjectHeader

lib/asf/AsfParser.ts

The vulnerability lies in the `parseObjectHeader` function, which is responsible for parsing object headers in an ASF file. The function reads an object's size and calculates the remaining size of the object's data. However, it fails to validate that the calculated remaining size is non-negative. When a crafted ASF file with an object size of 0 is provided, the remaining size becomes negative. This negative value, when used in subsequent operations, leads to an infinite loop as the file pointer is moved backward, and the same data is processed repeatedly. The patch mitigates this by adding a check to ensure the remaining size is not negative, throwing an error if it is.

parseFile

lib/index.js

The `parseFile` function is a primary entry point for parsing media files. It is affected because it uses the vulnerable `AsfParser` to handle ASF files. When a user passes a malicious ASF file to this function, it triggers the infinite loop in `AsfParser.parseObjectHeader`, causing the entire application to hang. While not the source of the vulnerability, it's a function that would appear in any runtime profile during exploitation.

parseBuffer

lib/index.js

Similar to `parseFile`, the `parseBuffer` function is another primary entry point for parsing media data from a buffer. It is also affected because it relies on the vulnerable `AsfParser`. Feeding a buffer containing a malicious ASF file to this function will trigger the infinite loop within the parser, leading to a denial-of-service condition. This function would also be present in a runtime profile during an exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.