CVE-2025-63648

CVE-2025-63648 concerns a NULL pointer dereference in the function dacp_reply_playqueueedit_move (src/httpd_dacp.c) in owntone-server, triggered by a crafted DACP request. The issue is tied to commit b7e385f and has been reported across multiple sources (SUSE, Red Hat, NVD, OSV, CVE lists). Docum...

PT-2026-3656

A NULL pointer dereference in the dacp reply playqueueedit move function src/httpd dacp.c of owntone-server commit b7e385f allows attackers to cause a Denial of Service DoS via sending a crafted DACP request to the server...