roderickvd pleezer up to 0.15.x Deezer Connect Protocol cleanup

Summaryinfo

A vulnerability classified as critical has been found in roderickvd pleezer up to 0.15.x. Impacted is an unknown function of the component Deezer Connect Protocol Handler. The manipulation leads to cleanup. This vulnerability is listed as CVE-2025-32439. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in roderickvd pleezer up to 0.15.x. It has been rated as critical. This issue affects some unknown processing of the component Deezer Connect Protocol Handler. The manipulation with an unknown input leads to a cleanup vulnerability. Using CWE to declare the problem leads to CWE-460. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow. Impacted is availability. The summary by CVE is:

pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versions before 0.16.0, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even during normal usage, every track change and playback event would leave behind zombie processes. This leads to inevitable resource exhaustion over time as the system's process table fills up, eventually preventing new processes from being created. The issue is exacerbated if events occur rapidly, whether through normal use (e.g., skipping through a playlist) or potential manipulation of the Deezer Connect protocol traffic. This issue has been fixed in version 0.16.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-32439 since 04/08/2025. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.16.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• roderickvd

Name

• pleezer

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15

Website

• Product: https://github.com/roderickvd/pleezer/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion