The owntone‑server software contains a buffer overflow vulnerability caused by insufficient recursive input validation. This flaw allows an attacker to write arbitrary data outside of the intended buffer boundaries, potentially corrupting memory and affecting the stability or security of the process. The weakness is identified as CWE‑120, which involves an out‑of‑bounds write.

The issue appears in owntone‑server at commit 2ca10d9 and is present in any earlier releases that include the same code path. No other vendors or products are known to be affected, so only installations of this software version are at risk.

The vulnerability scores a CVSS base score of 9.8, indicating a very high severity level. The EPSS score is below 1 %, suggesting that exploitation attempts are currently rare, and it is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is through malformed input supplied to the server, which could be local or remote if the vulnerable functionality is reachable across a network. The potential impact includes program corruption, denial of service, or in the worst case arbitrary code execution if the overflow is leveraged successfully.