Vulnerability · Published Jul 9, 2026 · Assigned by VulDB
CVE-2026-15276pdeljanov Symphonia Metadata denial of service
Low 3.3
In plain English
A low-severity security flaw in Symphonia from pdeljanov. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | rust-symphonia | no fix listed | UBUNTU-CVE-2026-15276 |
| Ubuntu:26.04:LTS | rust-symphonia | no fix listed | UBUNTU-CVE-2026-15276 |
| Ubuntu:26.10 | rust-symphonia | no fix listed | UBUNTU-CVE-2026-15276 |
Affected products (as reported)
Weakness: CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-377216 | pdeljanov Symphonia Metadata denial of service vdb-entry
- VDB-377216 | CTI Indicators (IOB, IOC) signature, permissions-required
- CVE-2026-15276 | CVE Analysis and Report third-party-advisory
- Submit #852458 | Symphonia symphonia-metadata <= 0.6.0 Denial of Service third-party-advisory
- https://github.com/pdeljanov/Symphonia/issues/508 exploit, issue-tracking
- https://github.com/pdeljanov/Symphonia/pull/514 issue-tracking, patch
- https://github.com/pdeljanov/Symphonia/ product