CVE-2026-49127: Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcmunpack24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Music Player Daemon (MPD)to a version that resolves this vulnerability.Fixed in 0.24.11 - Compensating control
Restrict network access to MPD so unauthenticated attackers cannot issue MPD commands that reference malicious HTTP audio sources (limit who can connect to the MPD control interface).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49127?
CVE-2026-49127 has a high severity rating of 8.6.
How do I fix CVE-2026-49127?
To fix CVE-2026-49127, upgrade Music Player Daemon to version 0.24.11 or later.
What type of vulnerability is CVE-2026-49127?
CVE-2026-49127 is a stack buffer overflow vulnerability.
What component of Music Player Daemon is affected by CVE-2026-49127?
CVE-2026-49127 affects the pcm_unpack_24be function in the PCM decoder plugin.
Who can exploit CVE-2026-49127?
CVE-2026-49127 can be exploited by unauthenticated attackers.