CVE-2026-88365

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.

Published 2026-09-24. Last modified 2026-09-29.