PT-2026-44494
CVE-2026-49127
·
Published
2026-05-28
·
Updated
2026-05-28
Description by
CVSS 4.0
8.8
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Music Player Daemon (MPD) versions prior to 0.24.11
Description
A stack buffer overflow exists in the
pcm unpack 24be() function within src/pcm/Pack.cxx. This issue allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. By issuing two MPD commands that reference a malicious HTTP audio source, an attacker can cause the unpack loop to write 1366 entries into a 1365-entry buffer. This process overwrites four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, which can lead to daemon termination or potential code execution.Recommendations
Update to version 0.24.11 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾