Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by VulnCheck

CVE-2026-49130Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

Medium 5.3

In plain English

A medium-severity security flaw in MPD from MusicPlayerDaemon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mpdno fix listedDEBIAN-CVE-2026-49130
Debian:13mpdno fix listedDEBIAN-CVE-2026-49130
Debian:14mpd0.24.12-1DEBIAN-CVE-2026-49130
Ubuntu:22.04:LTSmpdno fix listedUBUNTU-CVE-2026-49130
Ubuntu:24.04:LTSmpdno fix listedUBUNTU-CVE-2026-49130
Ubuntu:25.10mpdno fix listedUBUNTU-CVE-2026-49130
Ubuntu:26.04:LTSmpdno fix listedUBUNTU-CVE-2026-49130
Ubuntu:26.10mpdno fix listedUBUNTU-CVE-2026-49130

Affected products (as reported)

VendorProductVersions
MusicPlayerDaemon MPD 0 – before 0.24.11

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References