CVE-2026-49127 is a stack buffer overflow vulnerability in Music Player Daemon (MPD) before version 0.24.11. The flaw exists in the pcm_unpack_24be function within src/pcm/Pack.cxx, where an off-by-one write occurs during the unpacking loop. Specifically, the function writes 1366 entries into a buffer sized for 1365 entries, overwriting four bytes past the buffer boundary with three attacker-controlled bytes from an HTTP response body. This vulnerability can be triggered by unauthenticated attackers issuing two MPD commands referencing a malicious HTTP audio source, leading to daemon termination or potential arbitrary code execution.

The vulnerability allows unauthenticated remote attackers to corrupt stack memory, which can cause the Music Player Daemon to crash or potentially enable arbitrary code execution. This poses a high risk to systems running affected versions of MPD, as it can lead to denial of service or compromise of the host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted HTTP audio sources with MPD and consider restricting network access to the daemon to trusted users only.