—

RUSTSEC-2025-0027

Panic in mp3-metadata due to the lack of bounds checking

Details

The `get_id3()` methods used by `mp3_metadata::read_from_slice()` does not perform adequate bounds checking when recreating the tag due to the use of desynchronization.

Fixed in [Fix index error](https://github.com/GuillaumeGomez/mp3-metadata/pull/37), released as part of 0.4.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/mp3-metadata

Introduced in: 0.0.0-0Fixed in: 0.4.0

Upgrade mp3-metadata to 0.4.0 or newer (ecosystem crates.io).

References

https://crates.io/crates/mp3-metadata[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2025-0027.html[ADVISORY]
https://github.com/GuillaumeGomez/mp3-metadata/issues/36[REPORT]