music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf…

CVE-2026-32256 affects the music-metadata library, a parser for audio and video media files. The vulnerability exists in the ASF parser's parseExtensionObject() function in lib/asf/AsfParser.ts at lines 112-158. When a sub-object inside the ASF Header Extension Object has objectSize = 0, the parser enters an infinite loop causing a denial of service condition. This could allow attackers to craft malicious ASF files that cause applications using the library to hang indefinitely. The issue was fixed in version 11.12.3 of the music-metadata library.