CVE-2025-57156

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Jan 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-57167.3A vulnerability classified as critical has been found in SourceCodester Open Source Clinic Management System 1.0. Affected is an unknown fun CVE-2025-571646.5Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.CVE-2025-57177.2An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event pr CVE-2025-571749.8An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previo CVE-2025-571756.8Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.CVE-2025-571766.5On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP po CVE-2025-57186.8The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Ax CVE-2025-57195.1The wallet has an authentication bypass vulnerability that allows access to specific pages.CVE-2025-571976.0In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change featu CVE-2025-571988.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i CVE-2025-571998.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i CVE-2025-57206.4The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all ver