diff --git a/NEWS b/NEWS
index 37c351447..59e60e159 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ ver 0.21.6 (not yet released)
   - allow loading playlists specified as absolute filesystem paths
 * input
   - cdio_paranoia: fix build failure due to missing #include
+* playlist
+  - flac: fix use-after-free bug
 * support abstract sockets on Linux
 
 ver 0.21.5 (2019/02/22)
diff --git a/src/playlist/plugins/FlacPlaylistPlugin.cxx b/src/playlist/plugins/FlacPlaylistPlugin.cxx
index cdaada6ae..c16b9d674 100644
--- a/src/playlist/plugins/FlacPlaylistPlugin.cxx
+++ b/src/playlist/plugins/FlacPlaylistPlugin.cxx
@@ -34,7 +34,7 @@
 #include <FLAC/metadata.h>
 
 class FlacPlaylist final : public SongEnumerator {
-	const char *const uri;
+	const std::string uri;
 
 	FLAC__StreamMetadata *const cuesheet;
 	const unsigned sample_rate;