PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49127 MusicPlayerDaemon CVE debrief

A stack buffer overflow vulnerability exists in Music Player Daemon (MPD) versions prior to 0.24.11. The flaw resides in the `pcm_unpack_24be` function within `src/pcm/Pack.cxx`, where an off-by-one write condition allows 1366 entries to be written into a 1365-entry buffer. Unauthenticated attackers can exploit this by issuing two MPD commands that reference a malicious HTTP audio source, causing the PCM decoder plugin to write four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body. This results in daemon termination or potential code execution. The vulnerability was disclosed on 2026-05-28 and assigned CVSS 4.0 score 8.8 (HIGH severity). MPD version 0.24.11 contains the fix.

Vendor
MusicPlayerDaemon
Product
MPD
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-14
Advisory published
2026-05-28
Advisory updated
2026-07-14

Who should care

Organizations running Music Player Daemon (MPD) for audio streaming services, particularly those exposing MPD control interfaces to untrusted networks. System administrators managing Linux/Unix audio servers. Security teams monitoring for buffer overflow vulnerabilities in media processing applications.

Technical summary

The vulnerability exists in the `pcm_unpack_24be` function in `src/pcm/Pack.cxx`. An off-by-one error causes a loop to write one entry beyond the allocated buffer size (1366 entries written to 1365-entry buffer). The overflow overwrites four bytes past the array boundary with three bytes of attacker-controlled data from a malicious HTTP audio stream. The attack requires two MPD commands to trigger the vulnerable code path. The corrupted stack memory can lead to denial of service through daemon termination or potentially arbitrary code execution.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Music Player Daemon to version 0.24.11 or later
  • Restrict network access to MPD control ports to trusted hosts only
  • Monitor for unexpected MPD daemon crashes or terminations
  • Review MPD configuration to disable HTTP audio streaming if not required
  • Apply principle of least privilege when running MPD service

Evidence notes

The vulnerability is classified as CWE-193 (Off-by-one Error). The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects confidentiality (low), integrity (low), and availability (high).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49127 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49127

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49127 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49127

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.