CVE-2022-48363: Musicpd Music Player Daemon

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient because libqtappfw passes in a NULL pointer.

Affected products

• Musicpd Music Player Daemon: before 0.23.8 (fixed in 0.23.8)

Published 2023-02-26. Last modified 2026-06-17.