{"id":"CVE-2026-25068","aliases":["AZL-75773","AZL-76295","BELL-CVE-2026-25068","DEBIAN-CVE-2026-25068","DLA-4469-1","EUVD-2026-4970","GHSA-x6vq-264g-8wcx","MGASA-2026-0369","OESA-2026-1582","RHSA-2026:7401","UBUNTU-CVE-2026-25068","USN-8044-1","USN-8044-2"],"status":"published","title":"alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00195,"percentile":0.09357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2026-01-29T19:08:03Z","modified":"2026-10-28T11:10:13Z","fixes":[{"ecosystem":"Azure Linux:3","package":"alsa-lib","fixed_in":["1.2.9-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"alsa-lib","fixed_in":["1.2.6.1-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"alsa-lib","fixed_in":["1.2.8-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"alsa-lib","fixed_in":["1.2.14-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"alsa-lib","fixed_in":["1.2.15.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"alsa-lib","fixed_in":["1.2.14-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"alsa-lib","fixed_in":["1.2.16-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"alsa-lib","fixed_in":["1.2.4-1.1+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"alsa-lib","fixed_in":["1.2.3-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"alsa-lib","fixed_in":["1.2.5.1-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"alsa-lib","fixed_in":["1.2.10-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"alsa-lib","fixed_in":["1.2.10-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"alsa-lib","fixed_in":["1.2.10-4.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"alsa-lib","fixed_in":["1.2.10-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"alsa-lib","fixed_in":["0:1.2.15.3-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"alsa-lib-devel","fixed_in":["0:1.2.15.3-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alsa-lib","fixed_in":["1.2.2-2.1ubuntu2.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"alsa-lib","fixed_in":["1.2.6.1-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"alsa-lib","fixed_in":["1.2.11-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"alsa-lib","fixed_in":["1.2.14-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"alsa-lib","fixed_in":["1.2.15.3-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.8-r0"},{"fixed":"1.2.8-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.14-r0"},{"fixed":"1.2.14-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.7.2-r0"},{"fixed":"1.2.15.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.10-1","1.2.10-2","1.2.10-3","1.2.10-3.1","1.2.10-3.1~exp1","1.2.10-3.1~exp2","1.2.10-3.2","1.2.11-1","1.2.12-1","1.2.13-1","1.2.14-1","1.2.14-2","1.2.15-1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.16-1","1.2.16.1-1","1.2.16.1-1~bpo13+1","1.2.16.1-2","1.2.8-1","1.2.9-1","1.2.9-2"]},{"source":"osv","ecosystem":"Debian:13","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-1+deb13u1"}]}],"versions":["1.2.14-1"]},{"source":"osv","ecosystem":"Debian:14","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.16-1"}]}],"versions":["1.2.14-1","1.2.14-2","1.2.15-1","1.2.15-2","1.2.15.1-1","1.2.15.3-1"]},{"source":"osv","ecosystem":"Debian:11","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1.1+deb11u1"}]}],"versions":["1.2.4-1.1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libalsa2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.2-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"libalsa2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5.1-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-4.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15.3-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"alsa-lib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.15.3-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2.1ubuntu2.5+esm1"}]}],"versions":["1.1.9-0ubuntu1","1.2.1.2-2ubuntu2","1.2.2-2ubuntu1","1.2.2-2.1","1.2.2-2.1ubuntu1","1.2.2-2.1ubuntu2","1.2.2-2.1ubuntu2.1","1.2.2-2.1ubuntu2.2","1.2.2-2.1ubuntu2.3","1.2.2-2.1ubuntu2.4","1.2.2-2.1ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-1ubuntu1.1"}]}],"versions":["1.2.4-1.1ubuntu3","1.2.4-1.1ubuntu4","1.2.5.1-1ubuntu1","1.2.6.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1ubuntu0.2"}]}],"versions":["1.2.9-2","1.2.10-1","1.2.10-2","1.2.10-3","1.2.10-3build1","1.2.11-1build1","1.2.11-1build2","1.2.11-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-1ubuntu1.1"}]}],"versions":["1.2.13-1build1","1.2.14-1","1.2.14-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.3-1ubuntu1"}]}],"versions":["1.2.14-1ubuntu1","1.2.14-2ubuntu1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.15.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-1ubuntu1.1"}]}],"versions":["1.2.4-1.1ubuntu3","1.2.4-1.1ubuntu4","1.2.5.1-1ubuntu1","1.2.6.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1ubuntu0.2"}]}],"versions":["1.2.9-2","1.2.10-1","1.2.10-2","1.2.10-3","1.2.10-3build1","1.2.11-1build1","1.2.11-1build2","1.2.11-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-1ubuntu1.1"}]}],"versions":["1.2.13-1build1","1.2.14-1","1.2.14-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2.1ubuntu2.5+esm1"}]}],"versions":["1.1.9-0ubuntu1","1.2.1.2-2ubuntu2","1.2.2-2ubuntu1","1.2.2-2.1","1.2.2-2.1ubuntu1","1.2.2-2.1ubuntu2","1.2.2-2.1ubuntu2.1","1.2.2-2.1ubuntu2.2","1.2.2-2.1ubuntu2.3","1.2.2-2.1ubuntu2.4","1.2.2-2.1ubuntu2.5"]}],"products":[{"vendor":"alsa project","product":"alsa-lib"}],"references":[{"url":"https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40","tags":["patch","fix","article"]},{"url":"https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow","tags":["third-party-advisory","advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25068","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x6vq-264g-8wcx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-25068","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25068.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25068","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35934","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8044-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8538-1","tags":["advisory"]},{"url":"https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1582","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7401","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25068","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7401.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2435372","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25068","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-25068","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8044-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25068","title":"alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T19:08:03.986Z","modified":"2026-05-25T23:41:42.812Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-4970","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T19:08:03Z","modified":"2026-05-25T23:41:42Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:21:07.775399Z"}],"ghsa":[{"id":"GHSA-x6vq-264g-8wcx","title":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap...","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T21:30:31Z","modified":"2026-02-06T03:30:19Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:06:04.731011Z"}],"nvd":[{"id":"CVE-2026-25068","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T20:16:10.623Z","modified":"2026-06-17T10:24:04.38Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-25068","title":"alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T19:08:03.986Z","modified":"2026-10-28T11:10:13.095984405Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-25068","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T20:16:10.623Z","modified":"2026-10-01T03:03:00.670604919Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"OESA-2026-1582","title":"alsa-lib security update","description":"The alsa-lib is a library to interface with ALSA in the Linux kernel\nand virtual devices using a plugin system.\nMore detail: https://alsa.opensrc.org/Alsa-lib\r\n\r\n\nSecurity Fix(es):\n\nalsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.(CVE-2026-25068)","status":"published","published":"2026-03-15T11:10:35Z","modified":"2026-08-18T01:19:37.508362565Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:7401","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:14Z","modified":"2026-10-06T10:30:42.506016735Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-25068","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T20:16:00Z","modified":"2026-06-09T17:14:26.93304815Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-75773","title":"CVE-2026-25068 affecting package alsa-lib for versions less than 1.2.9-2","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T20:16:10Z","modified":"2026-08-28T17:47:50.387194227Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-76295","title":"CVE-2026-25068 affecting package alsa-lib for versions less than 1.2.6.1-3","description":"alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.","status":"published","published":"2026-01-29T20:16:10Z","modified":"2026-04-21T04:39:01.888474Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"BELL-CVE-2026-25068","status":"published","published":"2026-01-30T06:07:00.851579Z","modified":"2026-02-11T07:44:16.271731Z","updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"DLA-4469-1","title":"alsa-lib - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-02-05T23:30:05.311931Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2026-0369","title":"Updated libalsa2 packages fix security vulnerabilities","description":"alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow.\n(CVE-2026-25068)\nALSA Library \u003c 1.2.16.1 Double-Free via parse_def() in conf.c.\n(CVE-2026-56109)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:00:04.92926149Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8044-1","title":"alsa-lib vulnerability","description":"It was discovered that alsa-lib incorrectly handled the topology mixer\ncontrol decoder. A local attacker could use a specially crafted topology\nfile to cause alsa-lib to crash, resulting in a denial of service, or\npossibly execute arbitrary code.","status":"published","published":"2026-02-16T14:01:32Z","modified":"2026-04-27T18:38:37.745151Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8044-2","title":"alsa-lib vulnerability","description":"USN-8044-1 fixed a vulnerability in alsa-lib. This update provides the\ncorresponding fix for alsa-lib on Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that alsa-lib incorrectly handled the topology mixer\n control decoder. A local attacker could use a specially crafted topology\n file to cause alsa-lib to crash, resulting in a denial of service, or\n possibly execute arbitrary code.","status":"published","published":"2026-06-09T09:23:55Z","modified":"2026-06-09T17:14:27.243407478Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}