Executive brief
Music Player Daemon (MPD), a popular service for playing music across networks, is vulnerable to a flaw in how it handles certain playlist files. An attacker can provide a specially crafted playlist that tricks the system into injecting fake information into its internal responses. This can lead to music players displaying incorrect song details, desynchronizing the connection between the player and the server, or potentially misleading users with forged data.
Technical details
A CRLF injection vulnerability exists in the xspf_char_data function within the XSPF playlist plugin of MPD. The root cause is the improper handling of XML numeric character references (e.g., 
) which are decoded by the Expat library into literal carriage return and line feed bytes before being passed to the character data callback. Because MPD's wire protocol uses a newline-delimited key-value format, an attacker can supply a malicious XSPF playlist with these encoded characters in the <location> field to inject forged lines into protocol responses such as playlistinfo and currentsong. This can result in protocol desynchronization or the injection of arbitrary metadata. The issue is fixed in version 0.24.11.
Affected products
- MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11
Timeline
- 2026-05-14: disclosed: Issue reported on GitHub
- 2026-05-15: patched: Version 0.24.11 released
- 2026-05-28: advisory: NVD publication date
References
- https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7
- https://github.com/MusicPlayerDaemon/MPD/issues/2483
- https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11
- https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS
- https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/
- https://www.vulncheck.com/advisories/music-player-daemon-crlf-injection-via-xspfplaylistplugin-cxx