Out-of-Bounds Affecting mp3-metadata package, versions <0.4.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-MP3METADATA-10345081
- published12 Jun 2025
- disclosed30 Apr 2025
- creditUnknown
Introduced: 30 Apr 2025
CVE NOT AVAILABLE CWE-119 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade mp3-metadata to version 0.4.0 or higher.
Overview
mp3-metadata is a metadata parser for MP3 files.
Affected versions of this package are vulnerable to Out-of-Bounds due to inadequate bounds checking in the get_id3 method used by mp3_metadata::read_from_slice. An attacker can cause the application to crash by sending crafted input that exploits the desynchronization used in tag processing.