The vulnerability in tinytag causes an infinite loop during parsing of an ID3v2 SYLT (synchronized lyrics) frame. A specially crafted 498‑byte MP3 file can trigger the loop, preventing the library from completing the parse and locking the worker or process. Attackers who provide such a file to a server that automatically parses user files can force the application to hang indefinitely, effectively causing a denial of service.

Affected systems include any Python application using tinytag‑2.2.0. The library’s CPE entry identifies version 2.2.0 as vulnerable, and the issue has been addressed in version 2.2.1. Systems that perform server‑side media metadata extraction should review whether tinytag 2.2.0 is in use and update accordingly.

With a CVSS score of 6.5, the severity is moderate. The EPSS score is under 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating low public exploitation. Nonetheless, because the attack requires only the delivery of a malicious file, any service that accepts untrusted MP3 uploads is at risk. The fix is straightforward and supplied by the vendor, so the main risk is the potential for downtime rather than data breach.