# CVE-2026-49127: Music Player Daemon stack buffer overflow in PCM decoder

Source: https://junglewise.ai/threats/cve-2026-49127-music-player-daemon-stack-buffer-overflow-in-pcm-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-49127 · Severity: high · CVSS 8.6 · Published 2026-05-28

Music Player Daemon (MPD), a popular service for playing music across networks, is vulnerable to a memory corruption flaw. An unauthenticated attacker can exploit this by directing the daemon to play a specially crafted audio source from a malicious web server. This can result in the music service crashing (denial of service) or potentially allow the attacker to execute unauthorized code on the system.

Technologies: [MusicPlayerDaemon Music Player Daemon](https://junglewise.ai/threats/technologies/music-player-daemon). Vendors: [MusicPlayerDaemon](https://junglewise.ai/threats/vendors/musicplayerdaemon).

## Quick answers

**Is CVE-2026-49127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49127 being exploited in the wild.

**How severe is CVE-2026-49127?** High severity, with a CVSS score of 8.6, published 28 May 2026.

**Which products and versions are affected?** MusicPlayerDaemon Music Player Daemon before 0.24.11.

**Is there a fix for CVE-2026-49127?** A patch was published on 2026-05-14: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49127 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49127?** Check whether you run MusicPlayerDaemon Music Player Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the pcm_unpack_24be function within src/pcm/Pack.cxx due to an off-by-one error. The unpack_buffer in PcmDecoderPlugin.cxx is incorrectly sized at 1365 entries (4096/3) instead of the required 1366, leading to a 4-byte out-of-bounds write when processing a full 4096-byte FIFO buffer. An unauthenticated attacker can trigger this by issuing MPD commands (e.g., 'add' and 'play') referencing a malicious HTTP audio source serving audio/L24 data. This results in an out-of-bounds read of the FIFO and an out-of-bounds write of three attacker-controlled bytes from the HTTP response body, which can bypass stack canaries or corrupt adjacent memory. The issue is fixed in version 0.24.11.

## Affected products

- MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11

## Timeline

- 2026-05-14: disclosed: Issue reported on GitHub
- 2026-05-14: patched: Fix committed to repository
- 2026-05-15: advisory: Version 0.24.11 released
- 2026-05-28: other: CVE published

## References

- [https://github.com/MusicPlayerDaemon/MPD/commit/59911028c020f84bc2e669da6a1ef88121301274](https://github.com/MusicPlayerDaemon/MPD/commit/59911028c020f84bc2e669da6a1ef88121301274)
- [https://github.com/MusicPlayerDaemon/MPD/issues/2485](https://github.com/MusicPlayerDaemon/MPD/issues/2485)
- [https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11](https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11)
- [https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS](https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS)
- [https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/](https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/)
- [https://www.vulncheck.com/advisories/music-player-daemon-stack-buffer-overflow-via-pcm-unpack-24be](https://www.vulncheck.com/advisories/music-player-daemon-stack-buffer-overflow-via-pcm-unpack-24be)

## Related threats

- [Music Player Daemon CRLF injection in XSPF playlist plugin](https://junglewise.ai/threats/cve-2026-49130-music-player-daemon-crlf-injection-in-xspf-playlist-plugin)
- [Music Player Daemon path traversal in LocalStorage plugin](https://junglewise.ai/threats/cve-2026-49128-music-player-daemon-path-traversal-in-localstorage-plugin)