MusicPlayerDaemon MPD up to 0.24.10 PCM Decoder src/pcm/Pack.cxx pcm_unpack_24be off-by-one

Summaryinfo

A vulnerability described as critical has been identified in MusicPlayerDaemon MPD up to 0.24.10. The impacted element is the function pcm_unpack_24be of the file src/pcm/Pack.cxx of the component PCM Decoder. Executing a manipulation can lead to off-by-one. This vulnerability appears as CVE-2026-49127. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in MusicPlayerDaemon MPD up to 0.24.10. This vulnerability affects the function pcm_unpack_24be of the file src/pcm/Pack.cxx of the component PCM Decoder. The manipulation with an unknown input leads to a off-by-one vulnerability. The CWE definition for the vulnerability is CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution.

The weakness was presented by Matteo Strada and Daniele Berardinelli as 2485. The advisory is shared for download at musicpd.org. This vulnerability was named CVE-2026-49127 since 05/27/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.24.11 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 59911028c020f84bc2e669da6a1ef88121301274 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33000). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• MusicPlayerDaemon

Name

• MPD

Version

• 0.24.0
• 0.24.1
• 0.24.2
• 0.24.3
• 0.24.4
• 0.24.5
• 0.24.6
• 0.24.7
• 0.24.8
• 0.24.9
• 0.24.10

License

• open-source

Website

• Product: https://github.com/MusicPlayerDaemon/MPD/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion