Music Player Daemon (MPD) versions prior to 0.24.11 contain a stack buffer overflow in the pcm_unpack_24be function within the PCM decoder plugin. An unauthenticated attacker can trigger the flaw by issuing two MPD commands that reference a malicious HTTP audio source. The unpack loop then writes 1366 entries into a 1365–entry buffer, overwriting four bytes past the boundary with attacker‑controlled bytes from an HTTP response. This off‑by‑one write can cause the daemon to terminate or, if the overflow is exploited, allow arbitrary code execution, potentially compromising system integrity and availability.

The vulnerability affects the MusicPlayerDaemon:MPD product, impacting all releases before version 0.24.11. Users running any such prior version are at risk; no specific firmware or subscription tier mitigates the issue without updating.

The CVSS score of 8.8 classifies the flaw as high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can initiate exploitation remotely by sending crafted MPD commands over the audio protocol, without needing prior authentication. Because the flaw corrupts stack memory and can potentially lead to code execution, the risk to affected systems is significant, especially in environments where MPD listens on publicly reachable interfaces.