A NULL pointer dereference occurs in the daap_reply_playlists function of owntone-server, which can be triggered by sending a specially crafted DAAP request. The flaw causes the application to crash, resulting in a denial of service that can render the server unavailable to legitimate users. The vulnerability is identified as CWE‑476, a classic null pointer dereference flaw that directly impacts the runtime integrity of the server process.

The owntone‑server application is affected. No explicit vendor or product name is listed in the CNA data; however, the vulnerability is tied to a specific code commit (3d1652d). All releases prior to the fix commit (9ac54f0) are potentially vulnerable. Users should verify whether their installed version contains the vulnerable commit and upgrade accordingly.

The CVSS score of 7.5 indicates a high severity risk. While the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the flaw remains easy to exploit because the attack vector is via a standard DAAP request over the network. The attacker only needs to send a crafted request to reach the owntone-server instance. Because the weakness is a null pointer dereference, exploitation requires no special skills beyond crafting the request, resulting in an immediate server crash. This high severity DoS risk makes the vulnerability a top priority for any publicly exposed owntone-server deployment.