Borewit music-metadata

• CVE-2026-107392 Medium 6.2 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256) 0.4%
• CVE-2026-107391 Medium 6.2 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master 0.3%
• CVE-2026-107390 Medium 6.2 music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length 0.3%
• CVE-2026-107389 Medium 6.2 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort 0.2%
• CVE-2026-107388 Medium 6.2 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS 0.2%
• CVE-2026-107387 Medium 6.2 music-metadata: Uncontrolled memory allocation in APEv2 parser 0.2%
• CVE-2026-32256 High 7.5 music-metadata has an infinite loop vulnerability in ASF parser 0.4%