Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

minimp3 can miscalculate APEv2 tag size and crash

CVE-2026-88365 · published 25 days ago
Summary

The minimp3 library may overflow a number when it reads the size field of an APEv2 tag. This can cause the program using the library to stop working or behave unexpectedly. Upgrade to the latest minimp3 version or apply the available patch to fix the parsing logic.

Original advisory text
minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.
minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published24 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Sources
CVE-2026-88365 · NVD
CVE-2026-88365 · MITRE
Track software like this
Free during beta