CVE-2004-2779 describes a denial-of-service vulnerability in libid3tag versions through 0.15.1b. Specifically, the id3_utf16_deserialize() function in utf16.c mishandles UTF-16 encoded ID3v2 tags with an odd number of bytes, causing an infinite memory allocation loop. This leads to an out-of-memory condition, effectively crashing the affected application. With a CVSS score of 7.5 (HIGH), this vulnerability is remotely exploitable with low attack complexity, requiring no user interaction or privileges, and its sole impact is a complete loss of availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.15.1bCPE matchmatch criteria | cpe:2.3:a:underbit:libid3tag:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).
Feb 13, 2018libid3tag: id3_utf16_deserialize() misparses ID3v2 tags with an odd number of bytes resulting in an endless loop
Dec 31, 2004