CVE-2026-49127: Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be

Synopsis

A stack buffer overflow in Music Player Daemon (MPD) before version 0.24.11 allows unauthenticated remote attackers to corrupt stack memory through the pcm_unpack_24be function in the PCM decoder. The flaw is reachable over the network with no authentication required, by issuing two MPD commands that reference a crafted HTTP audio source, triggering an off-by-one write of 1366 entries into a 1365-entry buffer. Successful exploitation results in daemon termination or potential remote code execution. A patched-image rebuild at version 0.24.11 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MPD service over the network to issue the malicious commands that trigger the overflow.

• AuthenticationNot required

  No credentials are needed; the vulnerable code path is reachable by any unauthenticated client able to connect to the MPD service.

• Victim interactionNot required

  No user action is required; the attacker drives exploitation entirely through MPD protocol commands without any victim participation.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the service is reachable, with no race conditions or special environmental state required.

Blast Radius

• The MPD daemon process terminates, dropping all active playback sessions and making the audio service unavailable.
• An attacker controls three bytes written past the stack buffer boundary, which can corrupt the saved return address or adjacent stack frames, enabling potential remote code execution within the MPD process.
• Confidential data accessible to the MPD process, such as file paths, playlist contents, and low-sensitivity runtime state, may be read by an attacker who achieves code execution.
• Files and configuration writable by the MPD process user account may be modified if the attacker achieves code execution.