Key detail from vendor description: music‑metadata’s ASF parser (`parseExtensionObject()`) enters an infinite loop when a sub‑object inside the ASF Header Extension Object has `objectSize = 0`. This behavior, classified as CWE‑835 (Infinite Loop), results in the processing application becoming unresponsive, effectively denying service to legitimate users.

All releases of Borewit:music-metadata preceding version 11.12.3 are affected, as the vulnerability resides in the ASF parser module of those releases. The issue is fixed in version 11.12.3 and later.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could supply a crafted ASF file to a vulnerable application; if the application parses untrusted files, the attacker could trigger the infinite loop and deny availability of the service.