CVE-2026-49127

{"id": "CVE-2026-49127", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49127", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T19:14:21.889149Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/MusicPlayerDaemon/MPD", "vendor": "MusicPlayerDaemon", "product": "MPD", "versions": [{"status": "affected", "version": "0", "lessThan": "0.24.11", "versionType": "semver"}], "packageURL": "pkg:github/MusicPlayerDaemon/MPD", "defaultStatus": "affected"}]}], "published": "2026-05-28T20:16:26.387", "references": [{"url": "https://github.com/MusicPlayerDaemon/MPD/commit/59911028c020f84bc2e669da6a1ef88121301274", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/MusicPlayerDaemon/MPD/issues/2485", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11", "source": "disclosure@vulncheck.com"}, {"url": "https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html", "source": "disclosure@vulncheck.com"}, {"url": "https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS", "source": "disclosure@vulncheck.com"}, {"url": "https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/music-player-daemon-stack-buffer-overflow-via-pcm-unpack-24be", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled bytes from an HTTP response body, resulting in daemon termination or potential code execution."}, {"lang": "es", "value": "Music Player Daemon (MPD) antes de la versi\u00f3n 0.24.11 contiene una vulnerabilidad de desbordamiento de b\u00fafer de pila en la funci\u00f3n pcm_unpack_24be en src/pcm/Pack.cxx que permite a atacantes no autenticados corromper la memoria de pila al desencadenar una escritura off-by-one en el plugin decodificador PCM. Los atacantes pueden emitir dos comandos MPD referenciando una fuente de audio HTTP maliciosa para hacer que el bucle de descompresi\u00f3n escriba 1366 entradas en un b\u00fafer de 1365 entradas, sobrescribiendo cuatro bytes m\u00e1s all\u00e1 del l\u00edmite del array con tres bytes controlados por el atacante de un cuerpo de respuesta HTTP, lo que resulta en la terminaci\u00f3n del demonio o una potencial ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2026-10-26T13:10:00.140", "sourceIdentifier": "disclosure@vulncheck.com"}