Read the docs

MusicPlayerDaemon

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

MusicPlayerDaemon records in CISA KEV

No MusicPlayerDaemon vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-36343 CVE-2026-49128 · GHSA-r679-wq5x-vg3g

Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

Priority HIGH 77

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by j…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00637 Published 2026-05-28 Fixed in 0.24.11 CWE-22
TI-2026-36342 CVE-2026-49127 · GHSA-p9r5-qpp4-rjg3

Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be

Priority HIGH 77

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by trigger…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0051 Published 2026-05-28 Fixed in 0.24.11 CWE-193
TI-2026-36345 CVE-2026-49130 · GHSA-f8fv-fv9m-8539

Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

Priority HIGH 70

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0026 Published 2026-05-28 Fixed in 0.24.11 CWE-93
TI-2026-36344 CVE-2026-49129 · GHSA-5c2h-g7wx-c499

Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

Priority HIGH 70

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated a…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00281 Published 2026-05-28 Fixed in 0.24.11 CWE-918
Open these records in search →