Every CVE Search/ Get API key

CVE-2026-96674

alsa-lib through 1.2.16.1 Integer Overflow via Topology File

4.8 MediumFix available

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.11%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

alsa-lib through 1.2.16.1 Integer Overflow via Topology File

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
CVE-2026-96674
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-85346 4.8

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
EUVD-2026-85346
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w2qj-qh9f-h5cc 4.8

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src...

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
GHSA-w2qj-qh9f-h5cc
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 4.8

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
CVE-2026-96674
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
OSV 4.8

alsa-lib through 1.2.16.1 Integer Overflow via Topology File

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
CVE-2026-96674
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-190
Updated
2026-11-02
OSVDEBIAN-CVE-2026-96674 4.8

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
DEBIAN-CVE-2026-96674
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 8 moreShow less
OSVOESA-2026-4312 4.4

alsa-lib security update

The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib

Security Fix(es):

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.(CVE-2026-96674)

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.(CVE-2026-96675)

Record
OESA-2026-4312
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4313 4.4

alsa-lib security update

The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib

Security Fix(es):

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.(CVE-2026-96674)

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.(CVE-2026-96675)

Record
OESA-2026-4313
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4314 4.4

alsa-lib security update

The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib

Security Fix(es):

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.(CVE-2026-96674)

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.(CVE-2026-96675)

Record
OESA-2026-4314
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4315 4.4

alsa-lib security update

The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib

Security Fix(es):

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.(CVE-2026-96674)

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.(CVE-2026-96675)

Record
OESA-2026-4315
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-96674 4.8

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
UBUNTU-CVE-2026-96674
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVAZL-105054 No score

CVE-2026-96674 affecting package alsa-lib for versions less than 1.2.16.1-3

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.

Record
AZL-105054
Updated
2026-11-07
OSVopenSUSE-SU-2026:12147-1 No score

alsa-1.2.16.1-3.1 on GA media

These are all security issues fixed in the alsa-1.2.16.1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12147-1
Updated
2026-11-02
OSVSUSE-SU-2026:4735-1 No score

Security update for alsa

This update for alsa fixes the following issues:

  • CVE-2026-96674: computation of combined topology element size using 32-bit arithmetic in src/topology/ctl.c allows for integer overflow that can cause sensitive data leak and application crashes (bsc#1282564).
  • CVE-2026-96675: failure to validate sparse binding indices before array access when processing ALSA configuration files can lead to an assertion failure and an application abort (bsc#1282563).
Record
SUSE-SU-2026:4735-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
alsa-lib
Azure Linux:3
 before 1.2.16.1-3
1.2.16.1-3
alsa-lib
Debian:12
 All versions, plus listed versions
1.2.10-11.2.10-21.2.10-31.2.10-3.11.2.10-3.1~exp1
Show 17 moreShow less
1.2.10-3.1~exp21.2.10-3.21.2.11-11.2.12-11.2.13-11.2.14-11.2.14-21.2.15-11.2.15-21.2.15.1-11.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+11.2.8-11.2.9-11.2.9-2
 None known
alsa-lib
Debian:13
 All versions, plus listed versions
1.2.14-11.2.14-1+deb13u11.2.14-21.2.15-11.2.15-2
Show 5 moreShow less
1.2.15.1-11.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+1
 None known
alsa-lib
Debian:14
 All versions, plus listed versions
1.2.14-11.2.14-21.2.15-11.2.15-21.2.15.1-1
Show 4 moreShow less
1.2.15.3-11.2.16-11.2.16.1-11.2.16.1-1~bpo13+1
 None known
alsa-lib
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.2.10-7.oe2403sp1
1.2.10-7.oe2403sp1
alsa-lib
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.2.10-7.oe2403sp3
1.2.10-7.oe2403sp3
alsa-lib
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.2.10-7.oe2403sp4
1.2.10-7.oe2403sp4
alsa-lib
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.2.5.1-7.oe2203sp4
1.2.5.1-7.oe2203sp4
alsa
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 1.2.8-150500.3.6.1
1.2.8-150500.3.6.1
alsa-lib
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.0.27.2-1ubuntu61.0.27.2-1ubuntu71.0.27.2-3ubuntu11.0.27.2-3ubuntu21.0.27.2-3ubuntu51.0.27.2-3ubuntu61.0.27.2-3ubuntu7
 None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
alsa-lib
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.29-0ubuntu11.1.0-0ubuntu1
 None known
alsa-lib
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.3-51.1.3-5ubuntu0.11.1.3-5ubuntu0.21.1.3-5ubuntu0.41.1.3-5ubuntu0.51.1.3-5ubuntu0.6
 None known
alsa-lib
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.1.9-0ubuntu11.2.1.2-2ubuntu21.2.2-2ubuntu11.2.2-2.11.2.2-2.1ubuntu1
Show 7 moreShow less
1.2.2-2.1ubuntu21.2.2-2.1ubuntu2.11.2.2-2.1ubuntu2.21.2.2-2.1ubuntu2.31.2.2-2.1ubuntu2.41.2.2-2.1ubuntu2.51.2.2-2.1ubuntu2.5+esm1
 None known
alsa-lib
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.4-1.1ubuntu31.2.4-1.1ubuntu41.2.5.1-1ubuntu11.2.6.1-1ubuntu11.2.6.1-1ubuntu1.11.2.6.1-1ubuntu1.2
 None known
alsa-lib
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.9-21.2.10-11.2.10-21.2.10-31.2.10-3build1
Show 5 moreShow less
1.2.11-1build11.2.11-1build21.2.11-1ubuntu0.11.2.11-1ubuntu0.21.2.11-1ubuntu0.3
 None known
alsa-lib
Ubuntu:26.10
 All versions, plus listed versions
1.2.15.3-1ubuntu11.2.16.1-1
 None known
alsa-lib
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.14-1ubuntu11.2.14-2ubuntu11.2.15-21.2.15.1-11.2.15.3-11.2.15.3-1build11.2.15.3-1ubuntu11.2.15.3-1ubuntu1.1
 None known
alsa
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.2.16.1-3.1
1.2.16.1-3.1

History

History
RecordedChangedSources
affected, factsOSV
affected, facts
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96674 is a medium vulnerability (CVSS 4.8) in Alsa Project Alsa-lib, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in alsa-lib 1.2.16.1-3.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open