CyberSecBulletin

MusicPlayerDaemon vulnerabilities

We track 2 vulnerabilities in MusicPlayerDaemon products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 28, 2026.

2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score

Latest MusicPlayerDaemon vulnerabilities

  • 7.5 High severity

    MPD: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2026-49128MusicPlayerDaemon

    Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supp

  • 8.6 High severity

    MPD: Off-by-one Error

    CVE-2026-49127MusicPlayerDaemon

    Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decod