Is CVE-2026-49127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49127 being exploited in the wild.

How severe is CVE-2026-49127?

High severity, with a CVSS score of 8.6, published 28 May 2026.

Which products and versions are affected?

MusicPlayerDaemon Music Player Daemon before 0.24.11.

Is there a fix for CVE-2026-49127?

A patch was published on 2026-05-14: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49127 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-49127?

Check whether you run MusicPlayerDaemon Music Player Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49127: Music Player Daemon stack buffer overflow in PCM decoder

CVE-2026-49127 · Severity: high · CVSS 8.6 · Published 2026-05-28

Music Player Daemon (MPD), a popular service for playing music across networks, is vulnerable to a memory corruption flaw. An unauthenticated attacker can exploit this by directing the daemon to play a specially crafted audio source from a malicious web server. This can result in the music service crashing (denial of service) or potentially allow the attacker to execute unauthorized code on the system.

Technologies: MusicPlayerDaemon Music Player Daemon. Vendors: MusicPlayerDaemon.

Quick answers

Is CVE-2026-49127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49127 being exploited in the wild.
How severe is CVE-2026-49127?: High severity, with a CVSS score of 8.6, published 28 May 2026.
Which products and versions are affected?: MusicPlayerDaemon Music Player Daemon before 0.24.11.
Is there a fix for CVE-2026-49127?: A patch was published on 2026-05-14: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49127 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49127?: Check whether you run MusicPlayerDaemon Music Player Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the pcm_unpack_24be function within src/pcm/Pack.cxx due to an off-by-one error. The unpack_buffer in PcmDecoderPlugin.cxx is incorrectly sized at 1365 entries (4096/3) instead of the required 1366, leading to a 4-byte out-of-bounds write when processing a full 4096-byte FIFO buffer. An unauthenticated attacker can trigger this by issuing MPD commands (e.g., 'add' and 'play') referencing a malicious HTTP audio source serving audio/L24 data. This results in an out-of-bounds read of the FIFO and an out-of-bounds write of three attacker-controlled bytes from the HTTP response body, which can bypass stack canaries or corrupt adjacent memory. The issue is fixed in version 0.24.11.

Affected products

MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11

Timeline

2026-05-14: disclosed: Issue reported on GitHub
2026-05-14: patched: Fix committed to repository
2026-05-15: advisory: Version 0.24.11 released
2026-05-28: other: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.