MusicPlayerDaemon has 4 CVEs on record. The busiest recent month was May 2026 with 4. The median CVSS is 6.7 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.7
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
Worst active — by depth score
CVE-2026-49127High· 8.6Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be59CVE-2026-49128High· 7.5Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling53CVE-2026-49129Medium· 5.8Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin44CVE-2026-49130Medium· 5.3Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx41
MusicPlayerDaemon vulnerabilities
CVEs affecting MusicPlayerDaemon, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-49128High· 7.5PoCMusic Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling
Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storag…
CVE-2026-49127High· 8.6PoCMusic Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one…
CVE-2026-49130Medium· 5.3PoCMusic Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malic…
CVE-2026-49129Medium· 5.8PoCMusic Player Daemon < 0.24.11 SSRF via CurlInputPlugin
Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypas…