{"id":"RUSTSEC-2025-0027","summary":"Panic in mp3-metadata due to the lack of bounds checking","details":"The `get_id3()` methods used by `mp3_metadata::read_from_slice()` does not perform adequate bounds\nchecking when recreating the tag due to the use of desynchronization.\n\nFixed in [Fix index error](https://github.com/GuillaumeGomez/mp3-metadata/pull/37), released as\npart of 0.4.0.","aliases":["GHSA-927q-g9w9-pm54"],"modified":"2025-10-28T06:29:23.888737Z","published":"2025-04-28T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/mp3-metadata"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2025-0027.html"},{"type":"REPORT","url":"https://github.com/GuillaumeGomez/mp3-metadata/issues/36"}],"affected":[{"package":{"name":"mp3-metadata","ecosystem":"crates.io","purl":"pkg:cargo/mp3-metadata"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":["mp3_metadata::read_from_slice"],"os":[],"arch":[]}},"database_specific":{"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0027.json","categories":["denial-of-service"],"cvss":null}}],"schema_version":"1.7.3"}