Nested QuickTime upload exhausts getID3 worker memory

Summary

A crafted QuickTime container can recurse through nested atoms without a depth budget during normal video metadata processing, exhausting PHP worker memory.

Affected Products

WordPress core 7.0.4; getID3 QuickTime metadata parser.

Affected Scope

Product

WordPress

Component

getID3 QuickTime metadata parsing

Affected function

QuicktimeParseAtom(); wp_read_video_metadata(); .mov upload; nested atom data

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-400; CWE-674

Technical Summary

Nested QuickTime atoms recurse without a depth budget while atom data is retained. The upload-to-parser path makes this reachable through ordinary media metadata extraction.

Prerequisites and Permissions

Authenticated user with upload_files permission and a media upload path that performs video metadata extraction.

Affected Locations

wp-includes/ID3/module.audio-video.quicktime.php:276 QuicktimeParseAtom() declaration; 2352 recursive nested-atom call; wp-admin/includes/image.php: wp_read_video_metadata() parser setup.

Reproducible Proof

A bounded crafted .mov test caused the documented memory-growth/worker-exhaustion behavior in an isolated environment. The file generator and stress sample are withheld.

Vulnerable Code

public function QuicktimeParseAtom($atomname, $atomsize, $atom_data, $baseoffset, &$atomHierarchy, $ParseAllPossibleAtoms) {
	$atom_parent = end($atomHierarchy);
	array_push($atomHierarchy, $atomname);
	$atom_structure = array();
	$atom_structure[$subatomcounter++] = $this->QuicktimeParseAtom($subatomname, $subatomsize, $subatomdata, $baseoffset + $subatomoffset, $atomHierarchy, $ParseAllPossibleAtoms);
	$subatomoffset += $subatomsize;
}

Severity

low

Technical Analysis

wp_read_video_metadata() enables QuickTime atom data parsing. QuicktimeParseAtom() recursively parses nested subatoms and retains atom structures; the recursive call at the nested-atom sink has no depth/resource budget.

Impact

Availability impact: an authenticated user allowed to upload video can cause high memory use or worker termination during metadata extraction. No code execution or data disclosure is claimed.

Remediation

Limit atom nesting depth and aggregate parsed data, reject malformed/deep containers early, and enforce upload metadata-processing resource limits.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.