CVE-2025-44560
Published: 10 April 2026
Summary
CVE-2025-44560 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-44560 is a buffer overflow vulnerability in owntone-server at commit 2ca10d9, caused by a lack of recursive checking. This issue, classified under CWE-120 (Buffer Copy without Checking Size of Input), was published on 2026-04-10 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially leading to full system compromise.
Mitigation guidance and further details are provided in the project's GitHub issue at https://github.com/owntone/owntone-server/issues/1873 and a related Gist at https://gist.github.com/wenwenyuyu/517851c3fe38c4f97b2d1940597da2d3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209405
Vulnerability details
owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated buffer overflow in a network-exposed server (owntone-server) directly enables initial access via exploitation of a public-facing application, leading to RCE and full compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the buffer overflow vulnerability by requiring identification, reporting, and timely correction of the specific flaw in owntone-server.
Prevents buffer overflows by enforcing validation of network inputs to check sizes and recursive structures before copying.
Mitigates exploitation of the buffer overflow through memory safeguards like non-executable stacks and address randomization.