AIKIDO-2026-10412

TL;DR

When parsing streams of unknown size, the parser used larger read/skip limits (e.g. 16MB) for EBML, PNG, ASF, TIFF, and ZIP entry handling, and the ID3 probe only bounded each header size, not the cumulative read across repeated ID3 frames. An attacker can supply a crafted file or stream that triggers excessive reads or skips, causing high memory or CPU use and denial of service. The fix introduces a stricter budget for unknown-size payload probing (1MB), enforces a cumulative bound for ID3 probing (tokenizer.position + id3HeaderLength), and tightens ZIP scan budget and PNG/ASF/TIFF limits.