CVE-2026-49127

HighCVSS 8.6

Published: 28/05/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

A stack buffer overflow vulnerability in Music Player Daemon (MPD) before version 0.24.11 exists in the pcm_unpack_24be function in src/pcm/Pack.cxx. An unauthenticated attacker can trigger an off-by-one write by issuing two MPD commands referencing a malicious HTTP audio source, causing three attacker-controlled bytes to be written past a 1365-entry buffer.

Risk Assessment

The risk includes daemon termination (denial of service) and potential arbitrary code execution, which could compromise system integrity and availability.

Recommendation

Immediately upgrade MPD to version 0.24.11 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Music Player Daemon

CVE-2026-49130Medium
CRLF injection vulnerability in MPD before version 0.24.11 in the xspf_char_data function of the XSPF playlist plugin. Attackers can embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references.

Original NVD description (English source)

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.