NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
References
| Link | Resource |
|---|---|
| https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md | Patch Third Party Advisory |
| https://github.com/owntone/owntone-server/commit/5e4d40ee03ae22ab79534bb1410fa9db96c9fabd | Patch |
| https://github.com/owntone/owntone-server/issues/1907 | Exploit Issue Tracking |
Configurations
History
13 Feb 2026, 21:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:owntone:owntone_server:*:*:*:*:*:*:*:* | |
| First Time |
Owntone owntone Server
Owntone |
30 Jan 2026, 20:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Owntone Project owntone
Owntone Project |
|
| CPE | cpe:2.3:a:owntone_project:owntone:*:*:*:*:*:*:*:* | |
| References | () https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md - Patch, Third Party Advisory | |
| References | () https://github.com/owntone/owntone-server/commit/5e4d40ee03ae22ab79534bb1410fa9db96c9fabd - Patch | |
| References | () https://github.com/owntone/owntone-server/issues/1907 - Exploit, Issue Tracking |
21 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-476 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
20 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 21:16
Updated : 2026-02-13 21:04
NVD link : CVE-2025-57156
Mitre link : CVE-2025-57156
CVE.ORG link : CVE-2025-57156
JSON object : View
Products Affected
owntone
- owntone_server
CWE
CWE-476
NULL Pointer Dereference