Owntone is a media server application whose vulnerability profile centers on memory-safety issues within its core server component, specifically NULL pointer dereferences and use-after-free conditions. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Owntone over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-38383CRITICAL OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. | Aug 10, 2021 | 9.8 | 29 | NO | NO |
CVE-2026-41458HIGH OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting u | Apr 22, 2026 | 8.2 | 28 | NO | NO |
CVE-2025-63648HIGH A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via | Jan 20, 2026 | 7.5 | 28 | NO | NO |
CVE-2025-63647HIGH A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted D | Jan 20, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-41457MEDIUM OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by suppl | Apr 22, 2026 | 6.9 | 25 | NO | NO |
CVE-2025-57156HIGH NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remot | Jan 20, 2026 | 7.5 | 24 | NO | NO |
CVE-2025-57155HIGH NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to | Jan 20, 2026 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Owntone.
Media articles that mention a CVE ID that affects a product developed by Owntone — matched by CVE ID, not by vendor name.