The vulnerability is an integer overflow in the function mp3dec_skip_id3v1 of the minimp3 library, triggered while parsing the size field of an APEv2 tag. The overflow can corrupt internal state, potentially leading to undefined behavior or memory corruption.

This issue affects all versions of the minimp3 library that contain the vulnerable commit ea99364f and earlier. Since minimp3 is an open‑source decoder used in many multimedia applications, any build that has not been updated to the fixed commit is at risk.

The exploit requires an attacker to supply a crafted MP3 file containing an APEv2 tag that triggers the overflow. The CVSS score is 9.8, indicating critical severity. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV, indicating a low likelihood of exploitation. The vulnerability is triggered by parsing a user‑supplied audio file; an attacker must deliver malformed content to the decoder to induce the overflow.