What’s Vulnerable › Vulnerabilities

CVE-2022-48363

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-26 · updated 2026-06-17
• Weakness: CWE-617

Description

In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient because libqtappfw passes in a NULL pointer.

Affected products

• Musicpd Music Player Daemon: before 0.23.8 — fixed in 0.23.8

How to fix

Upgrade to a fixed version: Musicpd Music Player Daemon 0.23.8. Check the vendor advisory for mitigations.

References

• https://gerrit.automotivelinux.org/gerrit/c/src/libqtappfw/+/28484
• https://gerrit.automotivelinux.org/gerrit/c/src/libqtappfw/+/28485
• https://gerrit.automotivelinux.org/gerrit/q/project:src%252Flibqtappfw+status:open
• https://jira.automotivelinux.org/browse/SPEC-4661
• https://gerrit.automotivelinux.org/gerrit/c/src/libqtappfw/+/28484
• https://gerrit.automotivelinux.org/gerrit/c/src/libqtappfw/+/28485
• https://gerrit.automotivelinux.org/gerrit/q/project:src%252Flibqtappfw+status:open
• https://jira.automotivelinux.org/browse/SPEC-4661

Get alerted when CVE-2022-48363 or the next vulnerability affects your stack