CVE-2025-63648 | THREATINT

Description

A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server.

PUBLISHED Reserved 2025-10-27 | Published 2026-01-20 | Updated 2026-01-21 | Assigner mitre

References

github.com/owntone/owntone-server/issues/1933

github.com/...ommit/5f526c7a7e08c567a5c72421d74a79dafdd07621

github.com/...owntone-server/owntone-server-advisory-2025.md

cve.org (CVE-2025-63648)

nvd.nist.gov (CVE-2025-63648)

Download JSON