Executive brief
Music Player Daemon (MPD), a popular service for playing music across networks, is vulnerable to a memory corruption flaw. An unauthenticated attacker can exploit this by directing the daemon to play a specially crafted audio source from a malicious web server. This can result in the music service crashing (denial of service) or potentially allow the attacker to execute unauthorized code on the system.
Technical details
A stack-based buffer overflow exists in the pcm_unpack_24be function within src/pcm/Pack.cxx due to an off-by-one error. The unpack_buffer in PcmDecoderPlugin.cxx is incorrectly sized at 1365 entries (4096/3) instead of the required 1366, leading to a 4-byte out-of-bounds write when processing a full 4096-byte FIFO buffer. An unauthenticated attacker can trigger this by issuing MPD commands (e.g., 'add' and 'play') referencing a malicious HTTP audio source serving audio/L24 data. This results in an out-of-bounds read of the FIFO and an out-of-bounds write of three attacker-controlled bytes from the HTTP response body, which can bypass stack canaries or corrupt adjacent memory. The issue is fixed in version 0.24.11.
Affected products
- MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11
Timeline
- 2026-05-14: disclosed: Issue reported on GitHub
- 2026-05-14: patched: Fix committed to repository
- 2026-05-15: advisory: Version 0.24.11 released
- 2026-05-28: other: CVE published
References
- https://github.com/MusicPlayerDaemon/MPD/commit/59911028c020f84bc2e669da6a1ef88121301274
- https://github.com/MusicPlayerDaemon/MPD/issues/2485
- https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11
- https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS
- https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/
- https://www.vulncheck.com/advisories/music-player-daemon-stack-buffer-overflow-via-pcm-unpack-24be