CVE-2026-49127 is a stack buffer overflow vulnerability in Music Player Daemon (MPD) prior to version 0.24.11. The flaw exists in the pcm_unpack_24be function within src/pcm/Pack.cxx, where an off-by-one write occurs during the unpacking loop. Specifically, the function writes 1366 entries into a buffer sized for 1365 entries, overwriting four bytes beyond the buffer with three attacker-controlled bytes from an HTTP response body. This can be triggered by unauthenticated attackers issuing two MPD commands referencing a malicious HTTP audio source. The overflow may lead to daemon termination or potentially arbitrary code execution.

The vulnerability allows unauthenticated remote attackers to corrupt stack memory, which can cause the Music Player Daemon to crash or potentially enable code execution under the daemon's privileges. This poses a high risk to systems running vulnerable MPD versions, especially if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Music Player Daemon project for updates and consider restricting access to MPD services from untrusted sources until a fix is available.