LiveActive security incident?Get immediate response
CVE Record

CVE-2026-49130: Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.

MediumCVSS 6.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

MPD before 0.24.11 can mishandle a specially crafted XSPF playlist. An unauthenticated remote attacker may insert fake metadata lines into MPD responses and persisted state, potentially misleading applications, monitoring, or users that trust those values. The cited CVSS 4.0 score is 6.9, reflecting limited integrity impact without demonstrated confidentiality or availability impact.

Executive priority

Prioritize remediation on internet-reachable or shared MPD services that ingest untrusted playlists. For isolated installations with trusted-only playlist sources, schedule the supported upgrade through normal patching. Investigate promptly if dependent automation makes security or operational decisions from MPD metadata, because forged fields could undermine data integrity.

Technical view

Expat decodes XML numeric character references before MPD's xspf_char_data callback processes XSPF location values. Literal carriage-return and line-feed bytes can therefore enter URI fields and create forged key-value lines in playlistinfo, currentsong, listplaylist, and state-file output. This is CWE-93 CRLF injection and affects MPD versions earlier than 0.24.11.

Likely exposure

Exposure requires a vulnerable MPD instance to parse attacker-controlled or otherwise untrusted XSPF content. Risk is higher where playlists can be supplied remotely or imported from untrusted sources and downstream clients treat MPD response or state-file fields as authoritative. The bundle does not establish how commonly such configurations are deployed.

Exploitation context

The source bundle includes a public technical disclosure and patch references, so technical details are publicly available. However, the CVE is not listed as KEV, and the supplied sources do not establish active exploitation in the wild. No claim of observed attacks can be made from this evidence.

Researcher notes

The key boundary failure occurs after XML entity decoding: numeric character references become raw CR/LF before the XSPF callback handles the location value. Relevant sinks include multiple protocol outputs and persisted state. The supplied CVSS vector records low vulnerable-system integrity impact only. The bundle identifies issue 2483 and commit 855085b as tracking and patch references.

Mitigation direction

  • Upgrade MPD to version 0.24.11 or later using vendor-supported packages.
  • Restrict ingestion of XSPF playlists to trusted sources until upgrading.
  • Limit network access to MPD according to operational need.
  • Review vendor release notes and issue guidance for deployment-specific considerations.

Validation and detection

  • Inventory MPD versions and identify every instance earlier than 0.24.11.
  • Determine whether each instance accepts XSPF playlists from untrusted or remote sources.
  • Review MPD responses and state data for unexpected line-separated key-value fields.
  • After upgrading, confirm the running MPD version is 0.24.11 or later.
  • Verify dependent clients continue parsing playlist and current-song data correctly.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-93: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-49130 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.9 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.9CVSS 4.0MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheck
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

6.9Medium
CVSS 4.0 vector shape for CVE-2026-49130Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MusicPlayerDaemonMPD0affected
Weakness

CWE details

CWE-93

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-93 · source CWE mapping

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Improper Neutralization of CRLF Sequences ('CRLF Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs