Cyber Resilience

CVE-2025-44560

Critical

Published: 10 April 2026

Published
10 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0034 25.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-44560 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-44560 is a buffer overflow vulnerability in owntone-server at commit 2ca10d9, caused by a lack of recursive checking. This issue, classified under CWE-120 (Buffer Copy without Checking Size of Input), was published on 2026-04-10 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially leading to full system compromise.

Mitigation guidance and further details are provided in the project's GitHub issue at https://github.com/owntone/owntone-server/issues/1873 and a related Gist at https://gist.github.com/wenwenyuyu/517851c3fe38c4f97b2d1940597da2d3.

EU & UK References

Vulnerability details

owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated buffer overflow in a network-exposed server (owntone-server) directly enables initial access via exploitation of a public-facing application, leading to RCE and full compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-70314Shared CWE-120
CVE-2026-38426Shared CWE-120
CVE-2025-29329Shared CWE-120
CVE-2025-25567Shared CWE-120
CVE-2025-60553Shared CWE-120
CVE-2025-26005Shared CWE-120
CVE-2024-57482Shared CWE-120
CVE-2026-27459Shared CWE-120
CVE-2025-27836Shared CWE-120
CVE-2025-29137Shared CWE-120

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the buffer overflow vulnerability by requiring identification, reporting, and timely correction of the specific flaw in owntone-server.

prevent

Prevents buffer overflows by enforcing validation of network inputs to check sizes and recursive structures before copying.

prevent

Mitigates exploitation of the buffer overflow through memory safeguards like non-executable stacks and address randomization.

References