{"id":"GHSA-927q-g9w9-pm54","aliases":["RUSTSEC-2025-0027"],"url":"https://o3.security/vulnerability/GHSA-927q-g9w9-pm54","summary":"Panic in mp3-metadata due to the lack of bounds checking","details":"The `get_id3()` methods used by `mp3_metadata::read_from_slice()` does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.\n\nFixed in [Fix index error](https://github.com/GuillaumeGomez/mp3-metadata/pull/37), released as part of 0.4.0.","published":"2025-04-30T17:41:16Z","modified":"2025-10-28T06:29:23.888737Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"mp3-metadata","fixedVersion":"0.4.0"}],"fix":{"url":"https://github.com/GuillaumeGomez/mp3-metadata/pull/37","label":"GuillaumeGomez/mp3-metadata#37"},"references":[{"type":"WEB","url":"https://github.com/GuillaumeGomez/mp3-metadata/issues/36"},{"type":"WEB","url":"https://github.com/GuillaumeGomez/mp3-metadata/pull/37"},{"type":"PACKAGE","url":"https://github.com/GuillaumeGomez/mp3-metadata"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0027.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-28T06:29:23.888737Z"}}