Every CVE Search/ Get API key

CVE-2026-90781

alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

4.8 MediumPublic exploitFix available

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.18%Unchanged since Sep 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
CVE-2026-90781
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-193
Updated
2026-11-02
EUVDEUVD-2026-77008 4.8

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
EUVD-2026-77008
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f8w2-9vv9-pxwq 4.8

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse()...

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
GHSA-f8w2-9vv9-pxwq
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-193
Updated
2026-11-02
NVD 4.8

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
CVE-2026-90781
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-193
Updated
2026-11-02
OSV 4.8

alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
CVE-2026-90781
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-193
Updated
2026-11-02
OSVDEBIAN-CVE-2026-90781 4.8

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
DEBIAN-CVE-2026-90781
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2026-4119 4.8

alsa-lib security update

The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib

Security Fix(es):

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.(CVE-2026-90781)

Record
OESA-2026-4119
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVRHSA-2026:40573 6.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:40573
CVSS 3.1
6.8 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67289 6.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:67289
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-90781 4.8

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
UBUNTU-CVE-2026-90781
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-104928 No score

CVE-2026-90781 affecting package alsa-lib for versions less than 1.2.16.1-3

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Record
AZL-104928
Updated
2026-11-07
OSVopenSUSE-SU-2026:11783-1 No score

alsa-1.2.16.1-2.1 on GA media

These are all security issues fixed in the alsa-1.2.16.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11783-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
alsa-lib
Azure Linux:3
 before 1.2.16.1-3
1.2.16.1-3
alsa-lib
Debian:12
 All versions, plus listed versions
1.2.10-11.2.10-21.2.10-31.2.10-3.11.2.10-3.1~exp1
Show 18 moreShow less
1.2.10-3.1~exp21.2.10-3.21.2.11-11.2.12-11.2.13-11.2.14-11.2.14-21.2.15-11.2.15-21.2.15.1-11.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+11.2.16.1-21.2.8-11.2.9-11.2.9-2
 None known
alsa-lib
Debian:13
 All versions, plus listed versions
1.2.14-11.2.14-1+deb13u11.2.14-21.2.15-11.2.15-2
Show 6 moreShow less
1.2.15.1-11.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+11.2.16.1-2
 None known
alsa-lib
Debian:14
 before 1.2.16.1-2, plus listed versions
1.2.14-11.2.14-21.2.15-11.2.15-21.2.15.1-1
Show 4 moreShow less
1.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+1
1.2.16.1-2
alsa-lib
openEuler:24.03-LTS-SP4
 before 1.2.10-6.oe2403sp4
1.2.10-6.oe2403sp4
alsa-lib
openEuler:20.03-LTS-SP4
 before 1.2.3-4.oe2003sp4
1.2.3-4.oe2003sp4
alsa-lib
openEuler:22.03-LTS-SP4
 before 1.2.5.1-6.oe2203sp4
1.2.5.1-6.oe2203sp4
alsa-lib
openEuler:24.03-LTS-SP1
 before 1.2.10-6.oe2403sp1
1.2.10-6.oe2403sp1
alsa-lib
openEuler:24.03-LTS-SP3
 before 1.2.10-6.oe2403sp3
1.2.10-6.oe2403sp3
alsa-lib
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.2.16.1-2.hum1
0:1.2.16.1-2.hum1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
alsa-lib-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.2.16.1-2.hum1
0:1.2.16.1-2.hum1
alsa-topology
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.2.16.1-2.hum1
0:1.2.16.1-2.hum1
alsa-ucm
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.2.16.1-2.hum1
0:1.2.16.1-2.hum1
alsa-lib
Red Hat:hummingbird:1
 before 0:1.2.16.1-2.1.hum1
0:1.2.16.1-2.1.hum1
alsa-lib-devel
Red Hat:hummingbird:1
 before 0:1.2.16.1-2.1.hum1
0:1.2.16.1-2.1.hum1
alsa-topology
Red Hat:hummingbird:1
 before 0:1.2.16.1-2.1.hum1
0:1.2.16.1-2.1.hum1
alsa-ucm
Red Hat:hummingbird:1
 before 0:1.2.16.1-2.1.hum1
0:1.2.16.1-2.1.hum1
alsa-lib
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.0.27.2-1ubuntu61.0.27.2-1ubuntu71.0.27.2-3ubuntu11.0.27.2-3ubuntu21.0.27.2-3ubuntu51.0.27.2-3ubuntu61.0.27.2-3ubuntu7
 None known
alsa-lib
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.29-0ubuntu11.1.0-0ubuntu1
 None known
alsa-lib
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.3-51.1.3-5ubuntu0.11.1.3-5ubuntu0.21.1.3-5ubuntu0.41.1.3-5ubuntu0.51.1.3-5ubuntu0.6
 None known
alsa-lib
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.1.9-0ubuntu11.2.1.2-2ubuntu21.2.2-2ubuntu11.2.2-2.11.2.2-2.1ubuntu1
Show 7 moreShow less
1.2.2-2.1ubuntu21.2.2-2.1ubuntu2.11.2.2-2.1ubuntu2.21.2.2-2.1ubuntu2.31.2.2-2.1ubuntu2.41.2.2-2.1ubuntu2.51.2.2-2.1ubuntu2.5+esm1
 None known
alsa-lib
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.4-1.1ubuntu31.2.4-1.1ubuntu41.2.5.1-1ubuntu11.2.6.1-1ubuntu11.2.6.1-1ubuntu1.11.2.6.1-1ubuntu1.2
 None known
alsa-lib
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.9-21.2.10-11.2.10-21.2.10-31.2.10-3build1
Show 5 moreShow less
1.2.11-1build11.2.11-1build21.2.11-1ubuntu0.11.2.11-1ubuntu0.21.2.11-1ubuntu0.3
 None known
alsa-lib
Ubuntu:26.10
 All versions, plus listed versions
1.2.15.3-1ubuntu11.2.16.1-1
 None known
alsa-lib
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.14-1ubuntu11.2.14-2ubuntu11.2.15-21.2.15.1-11.2.15.3-11.2.15.3-1build11.2.15.3-1ubuntu11.2.15.3-1ubuntu1.1
 None known
alsa
openSUSE:Tumbleweed
 before 1.2.16.1-2.1
1.2.16.1-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubHarshRajSinghania/CVE-2026-90781-alsa-lib-oob2026-09-13

History

History
RecordedChangedSources
affectedOSV
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-90781 is a medium vulnerability (CVSS 4.8) in Alsa Project Alsa-lib, published August 19, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in alsa-lib 1.2.16.1-3.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open