MusicFreeDesktop CVE-2026-118578

Exploitation requires the attacker to be on the same local/adjacent network as a host running MusicFreeDesktop versions 0.0.6, 0.0.7, or 0.0.8, and to reach its 'Request Forwarder' component, which discloses information. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed. The dominant limiting factor is network adjacency (AV:A): the flaw is not exploitable over the internet, only from the local network segment. Impact is confidentiality-only and rated low (VC:L) - no integrity or availability effect. The specific feature behavior, configuration, or request that triggers the disclosure is not described in the available sources. No fixed version exists because the vendor has not responded.

Real-world risk is low and the signals are internally consistent. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, confidentiality-only VC:L, no integrity or availability impact) yields a score of 2.1, and the vuln.today decision label is 'monitor' - not an actionable emergency. The AV:A (adjacent) attack vector is the single largest risk limiter: an attacker must already be on the same local network segment as the victim, which excludes internet-wide, remote, unauthenticated mass exploitation. Exploit maturity is E:P (Proof-of-Concept), and a public PoC reference exists but is not verified as working exploit code; this is a distinct, weaker signal than active exploitation. No CISA KEV listing and no EPSS score were provided, so there is no evidence of widespread or targeted exploitation in the wild. The net picture is a genuine but minor local-network information-disclosure issue in a niche desktop application, not a priority for most environments. The main open-ended factor is the vendor's non-response: no patch exists yet because the maintainer has not acted on the issue report.

An attacker sharing a local network with a user running MusicFreeDesktop (0.0.6-0.0.8) reaches the application's 'Request Forwarder' component over that network and elicits disclosure of information the component should not expose. A public PoC reference exists but is not verified as working exploit code, so weaponization effort is unclear; the low-complexity, no-authentication, no-user-interaction profile (AC:L/PR:N/UI:N) means that if the PoC works, triggering it is straightforward for anyone already on the LAN.