A flaw in tinytag, a Python library for reading audio file metadata, causes the parser to enter an infinite loop when it encounters an M4A file that contains a sub‑atom with a zero size inside a ---- atom. The parser repeatedly processes the malformed atom without advancing the read pointer, eventually consuming all CPU resources of the process that invoked it. The effect is a denial of service against any application that attempts to read the crafted file, as the parsing operation will never terminate.

The vulnerability affects versions of tinytag from 2.0.0 through 2.2.x, which are widely used in Python projects for extracting metadata from MP4/M4A audio files. The fix was introduced in version 2.3.0, which restores proper handling of zero‑length atoms and prevents the parser from looping indefinitely.

The CVSS score of 6.5 classifies the issue as moderate severity. The EPSS score is not available, so the current exploitation likelihood is unclear. Because the vulnerability only causes a denial of service and does not allow code execution, it is listed as a functional flaw. Adversaries could exploit it by delivering a malicious M4A file to any service that relies on tinytag for metadata extraction, resulting in service disruption. The vulnerability is not currently catalogued in the CISA KEV list. The recommended attack vector is local or remote supply of a specially crafted file to an application that imports tinytag.