CVE-2026-49127High· 8.6▾ MidnightPoC availableMusic Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.
MPD < 0.24.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49128High· 7.5Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling
CVE-2026-49130Medium· 5.3Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
CVE-2026-49129Medium· 5.8Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin
CVE-2026-56787Medium· 6.5RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
CVE-2026-56790High· 7.3CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()
CVE-2024-1441Medium· 5.5Libvirt: off-by-one error in udevlistinterfacesbystatus()