What is the CVSS score of CVE-2025-57156?

CVE-2025-57156 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Owntone Server are affected by CVE-2025-57156?

CVE-2025-57156 presents notable security risk, a null pointer dereference vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-57156?

Yes, a public proof-of-concept exploit is available for CVE-2025-57156. Prioritise patching immediately. EPSS: 0.2%.

Owntone Server CVE-2025-57156

Q: How to fix or mitigate CVE-2025-57156?

Within 7 days: Identify all affected systems running the dacp_reply_playqueueedit_clear function in src/httpd_dac and apply vendor patches promptly. Vendor patch is available.

HIGH

NULL Pointer Dereference (CWE-476)

2026-01-20 cve@mitre.org

Denial Of Service Null Pointer Dereference Owntone Server Suse Owntone

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 13, 2026 - 21:04 vuln.today

Public exploit code

Patch released

Feb 13, 2026 - 21:04 nvd

Patch available

CVE Published

Jan 20, 2026 - 21:16 nvd

HIGH 7.5

DescriptionCVE.org

NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).

AnalysisAI

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). Affects the dacp_reply_playqueueedit_clear component of Owntone Server. NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).