---
id: CVE-2026-49127
title: Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
summary: >-
  Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer
  overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx
  that allows unauthenticated attackers to corrupt stack memory by triggering an
  off-by-one…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-193
vendor: MusicPlayerDaemon
product: MPD
affected:
  - MPD < 0.24.11
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-29T19:14:21.889149Z'
exploitAvailable: true
published: '2026-05-28'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:42.010Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49127'
references:
  - url: >-
      https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html
  - url: 'https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/'
  - url: 'https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS'
  - url: 'https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11'
    label: MPD 0.24.11 Release Notes
  - url: 'https://github.com/MusicPlayerDaemon/MPD/issues/2485'
  - url: >-
      https://github.com/MusicPlayerDaemon/MPD/commit/59911028c020f84bc2e669da6a1ef88121301274
  - url: >-
      https://www.vulncheck.com/advisories/music-player-daemon-stack-buffer-overflow-via-pcm-unpack-24be
tags:
  - cve.org
  - exploit-available
epss: 0.0051
epssPercentile: 0.43819
ingestedAt: '2026-11-08T14:51:22.391Z'
---

## Overview

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.

## Affected

- `MPD < 0.24.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.