PT-2026-44497 · Unknown · Music Player Daemon

Daniele Berardinelli + 1 · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-49130

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Music Player Daemon (MPD) versions prior to 0.24.11

Description A CRLF injection issue exists in the xspf char data() function within the XSPF playlist plugin. This occurs because Expat decodes XML numeric character references before the character data callback, allowing attackers to embed literal Carriage Return (CR) and Line Feed (LF) bytes in URI fields by providing a malicious XSPF playlist. Consequently, forged key-value lines can be injected via the location field into the state file writer and MPD protocol responses, specifically the 'playlistinfo', 'currentsong', and 'listplaylist' outputs.

Recommendations Update to version 0.24.11 or later.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-49130

Affected Products

Music Player Daemon

References · 15

• 🔥 https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html · Exploit
• https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-49130 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-49130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49130 · Security Note
• https://ubuntu.com/security/CVE-2026-49130 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-49130 · Security Note
• https://musicpd.org/news/2026/05/mpd-0-24-11-released · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-49130 · Vendor Advisory
• https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 · Note
• https://github.com/MusicPlayerDaemon/MPD/issues/2483 · Note
• https://vulncheck.com/advisories/music-player-daemon-crlf-injection-via-xspfplaylistplugin-cxx · Note
• https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS · Note
• https://t.me/cveNotify/165113 · Telegram Post
• https://twitter.com/CVEnew/status/2060091927895175495 · Twitter Post