EUVD-2026-33006
GHSA-f8fv-fv9m-8539
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.
AnalysisAI
CRLF injection in Music Player Daemon (MPD) before version 0.24.11 enables network-accessible, unauthenticated attackers to embed raw CR/LF bytes into URI fields parsed from malicious XSPF playlists, injecting forged key-value lines into MPD text protocol responses - including playlistinfo, currentsong, and listplaylist outputs - as well as the persistent state file. The root mechanism is Expat's decoding of XML numeric character references (e.g., ) before invoking the character data callback in xspf_char_data, bypassing any empty-string checks that previously served as the only guard. No public exploit code or CISA KEV listing exists at time of analysis, but the no-authentication network vector means any MPD instance that processes externally supplied playlists is exposed; the fix also extended to ASX, PLS, and RSS playlist plugins, indicating the affected surface was broader than the CVE title implies.
Technical ContextAI
MPD is an open-source, server-side music playback daemon using a text-based line-oriented protocol where key-value pairs are newline-delimited. The XSPF (XML Shareable Playlist Format) plugin uses the Expat XML parser; Expat resolves XML numeric character references to their literal Unicode values prior to invoking the character data (xspf_char_data) callback, meaning U+000D (CR) and U+000A (LF) encoded as and arrive as raw bytes in the parsed location/URI value. The pre-patch code checked only that the location string was non-empty before accepting it, providing no sanitization. CWE-93 (Improper Neutralization of CRLF Sequences) describes this root cause precisely: untrusted input containing CRLF is incorporated into a structured text protocol without escaping or rejection. The fix introduces a new VerifyUriUTF8() function in src/protocol/Verify.cxx that rejects strings failing UTF-8 validation (which implicitly rejects bare control characters), applied uniformly across XSPF, ASX, PLS, and RSS playlist plugins. Affected CPE: cpe:2.3:a:musicplayerdaemon:mpd:*:*:*:*:*:*:*:* for all versions prior to 0.24.11.
RemediationAI
Upgrade Music Player Daemon to version 0.24.11 or later, which is the vendor-released patch as confirmed by the release announcement at https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/. The specific fix commit is 855085b35c67dddeef0652e2cb3ac8cdd4f457b7 (https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7), which introduces VerifyUriUTF8() validation across the XSPF, ASX, PLS, and RSS playlist plugins. If immediate upgrade is not feasible, restrict which MPD clients are permitted to issue playlist-load commands referencing external URLs by applying network-level ACLs or MPD's built-in password/permission controls - note that this trades off playlist flexibility for reduced attack surface. Disabling remote playlist loading entirely at the perimeter (e.g., blocking outbound HTTP from the MPD process) prevents the server from fetching attacker-controlled content, but will break legitimate remote-playlist workflows.
The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet
The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication m
Stack buffer overflow in Music Player Daemon (MPD) versions prior to 0.24.11 allows remote unauthenticated attackers to
Information disclosure in Music Player Daemon (MPD) before 0.24.11 allows unauthenticated remote attackers to read arbit
Server-side request forgery in Music Player Daemon (MPD) before 0.24.11 allows unauthenticated remote attackers to bypas
Same technique Code Injection
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today