A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server.
References
| Link | Resource |
|---|---|
| https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md | Patch Third Party Advisory |
| https://github.com/owntone/owntone-server/commit/5f526c7a7e08c567a5c72421d74a79dafdd07621 | Patch |
| https://github.com/owntone/owntone-server/issues/1933 | Issue Tracking Patch |
Configurations
History
13 Feb 2026, 21:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Owntone owntone Server
Owntone |
|
| CPE | cpe:2.3:a:owntone:owntone_server:*:*:*:*:*:*:*:* |
30 Jan 2026, 20:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md - Patch, Third Party Advisory | |
| References | () https://github.com/owntone/owntone-server/commit/5f526c7a7e08c567a5c72421d74a79dafdd07621 - Patch | |
| References | () https://github.com/owntone/owntone-server/issues/1933 - Issue Tracking, Patch | |
| CPE | cpe:2.3:a:owntone_project:owntone:*:*:*:*:*:*:*:* | |
| First Time |
Owntone Project owntone
Owntone Project |
21 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-476 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
20 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 21:16
Updated : 2026-02-13 21:04
NVD link : CVE-2025-63648
Mitre link : CVE-2025-63648
CVE.ORG link : CVE-2025-63648
JSON object : View
Products Affected
owntone
- owntone_server
CWE
CWE-476
NULL Pointer Dereference