Is CVE-2026-49130 actively exploited?

No active exploitation of CVE-2026-49130 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49130 be exploited remotely?

Yes. CVE-2026-49130 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-49130?

CVE-2026-49130 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-49130

MEDIUM

CVE-2026-49130

CWE-93Published: May 28, 2026· Updated: May 29, 2026

5.3

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.5th

Official Description

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.

NVD Source

Technical Analysis

CVE-2026-49130 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.