CVE-2025-44560 -- CVSS 9.8 Vulnerability Briefing

CVE-2025-44560 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2025-44560 is a critical buffer overflow vulnerability in OwnTone Server (owntone-server), an open-source media server application, introduced at commit 2ca10d9, caused by insufficient recursive input validation.

Technical Detail

The flaw stems from a lack of recursive boundary checking within owntone-server's processing logic, allowing an attacker to supply crafted input that overflows an allocated buffer. Depending on the affected code path, successful exploitation could result in remote code execution or process crash, as buffer overflows of this class frequently enable an attacker to overwrite adjacent memory structures and redirect execution flow. The CVSS score of 9.8 indicates the vulnerability is likely remotely exploitable without authentication, placing it in the highest risk tier.

Exploitation Status

No known exploit has been publicly documented or confirmed for this vulnerability at this time. It is not listed in CISA's Known Exploited Vulnerabilities catalog. While the severity score warrants urgent attention, there is currently no evidence of active exploitation or proof-of-concept code in circulation.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence sources.

What To Do

Administrators running owntone-server should identify whether their deployed version includes commit 2ca10d9 or any subsequent unpatched build and prioritize upgrading to a remediated release as soon as one is available from the project maintainers. In the interim, restrict network access to the owntone-server interface using firewall rules or host-based controls, limiting exposure to trusted internal hosts only. Monitor the official OwnTone project repository and security advisories for patch availability. Given the critical CVSS rating and the remote exploitability profile, this should be treated as a high-priority remediation item even in the absence of confirmed active exploitation.