{"id":"CVE-2026-56109","aliases":["AZL-90204","BELL-CVE-2026-56109","DEBIAN-CVE-2026-56109","EUVD-2026-38301","GHSA-jfrh-w252-q2h4","MGASA-2026-0369","OESA-2026-2847","OESA-2026-2848","OESA-2026-2849","OESA-2026-2850","RHSA-2026:40573","ROOT-OS-ALPINE-324-CVE-2026-56109","SUSE-SU-2026:22291-1","SUSE-SU-2026:22381-1","SUSE-SU-2026:22667-1","SUSE-SU-2026:2885-1","SUSE-SU-2026:3270-1","SUSE-SU-2026:3492-1","UBUNTU-CVE-2026-56109","USN-8538-1","openSUSE-SU-2026:21075-1"],"status":"published","title":"ALSA Library \u003c 1.2.16.1 Double-Free via parse_def() in conf.c","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","severity":{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00138,"percentile":0.03263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2026-06-22T15:58:42Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"alsa-lib","fixed_in":["1.2.16.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"alsa-lib","fixed_in":["1.2.8-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"alsa-lib","fixed_in":["1.2.14-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"alsa-lib","fixed_in":["1.2.16.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"alsa-lib","fixed_in":["1.2.16.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"alsa-lib","fixed_in":["1.2.10-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"alsa-lib","fixed_in":["1.2.3-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"alsa-lib","fixed_in":["1.2.5.1-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"alsa-lib","fixed_in":["1.2.10-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.24","package":"alsa-lib","fixed_in":["1.2.15.3-r00071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.24","package":"rootio-alsa-lib","fixed_in":["1.2.15.3-r00071"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"alsa","fixed_in":["1.2.14-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alsa","fixed_in":["1.2.14-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alsa","fixed_in":["1.2.14-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"alsa","fixed_in":["1.2.10-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"alsa","fixed_in":["1.2.6.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"alsa","fixed_in":["1.2.6.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alsa","fixed_in":["1.2.10-150600.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"alsa","fixed_in":["1.2.8-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"alsa-lib","fixed_in":["1.2.6.1-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"alsa-lib","fixed_in":["1.2.11-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"alsa-lib","fixed_in":["1.2.15.3-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"alsa","fixed_in":["1.2.14-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.16.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.8-r0"},{"fixed":"1.2.8-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.14-r0"},{"fixed":"1.2.14-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.7.2-r0"},{"fixed":"1.2.16.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.10-1","1.2.10-2","1.2.10-3","1.2.10-3.1","1.2.10-3.1~exp1","1.2.10-3.1~exp2","1.2.10-3.2","1.2.11-1","1.2.12-1","1.2.13-1","1.2.14-1","1.2.14-2","1.2.15-1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.16-1","1.2.16.1-1","1.2.16.1-1~bpo13+1","1.2.16.1-2","1.2.8-1","1.2.9-1","1.2.9-2"]},{"source":"osv","ecosystem":"Debian:13","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.14-1","1.2.14-1+deb13u1","1.2.14-2","1.2.15-1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.16-1","1.2.16.1-1","1.2.16.1-1~bpo13+1","1.2.16.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.16.1-1"}]}],"versions":["1.2.14-1","1.2.14-2","1.2.15-1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.16-1","1.2.16.1-1~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libalsa2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.2-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"libalsa2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5.1-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.16.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"alsa-lib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.16.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"alsa-topology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.16.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"alsa-ucm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.16.1-2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.24","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.3-r00071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.24","package":"rootio-alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.3-r00071"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-150600.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.8-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.27.2-1ubuntu6","1.0.27.2-1ubuntu7","1.0.27.2-3ubuntu1","1.0.27.2-3ubuntu2","1.0.27.2-3ubuntu5","1.0.27.2-3ubuntu6","1.0.27.2-3ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.29-0ubuntu1","1.1.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-5","1.1.3-5ubuntu0.1","1.1.3-5ubuntu0.2","1.1.3-5ubuntu0.4","1.1.3-5ubuntu0.5","1.1.3-5ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.9-0ubuntu1","1.2.1.2-2ubuntu2","1.2.2-2ubuntu1","1.2.2-2.1","1.2.2-2.1ubuntu1","1.2.2-2.1ubuntu2","1.2.2-2.1ubuntu2.1","1.2.2-2.1ubuntu2.2","1.2.2-2.1ubuntu2.3","1.2.2-2.1ubuntu2.4","1.2.2-2.1ubuntu2.5","1.2.2-2.1ubuntu2.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-1ubuntu1.2"}]}],"versions":["1.2.4-1.1ubuntu3","1.2.4-1.1ubuntu4","1.2.5.1-1ubuntu1","1.2.6.1-1ubuntu1","1.2.6.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1ubuntu0.3"}]}],"versions":["1.2.9-2","1.2.10-1","1.2.10-2","1.2.10-3","1.2.10-3build1","1.2.11-1build1","1.2.11-1build2","1.2.11-1ubuntu0.1","1.2.11-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.13-1build1","1.2.14-1","1.2.14-1ubuntu1","1.2.14-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.3-1ubuntu1.1"}]}],"versions":["1.2.14-1ubuntu1","1.2.14-2ubuntu1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.15.3-1build1","1.2.15.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6.1-1ubuntu1.2"}]}],"versions":["1.2.4-1.1ubuntu3","1.2.4-1.1ubuntu4","1.2.5.1-1ubuntu1","1.2.6.1-1ubuntu1","1.2.6.1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1ubuntu0.3"}]}],"versions":["1.2.9-2","1.2.10-1","1.2.10-2","1.2.10-3","1.2.10-3build1","1.2.11-1build1","1.2.11-1build2","1.2.11-1ubuntu0.1","1.2.11-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"alsa-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15.3-1ubuntu1.1"}]}],"versions":["1.2.14-1ubuntu1","1.2.14-2ubuntu1","1.2.15-2","1.2.15.1-1","1.2.15.3-1","1.2.15.3-1build1","1.2.15.3-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-160000.3.1"}]}]}],"products":[{"vendor":"alsa project","product":"alsa-lib"},{"vendor":"alsa-project","product":"alsa-lib"}],"references":[{"url":"https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/","tags":["technical-description","exploit","evidence","web","article","report"]},{"url":"https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1","tags":["release-notes","advisory","article"]},{"url":"https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0","tags":["patch","fix","article"]},{"url":"https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c","tags":["third-party-advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56109","tags":["web","advisory"]},{"url":"https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com"},{"url":"https://github.com/advisories/GHSA-jfrh-w252-q2h4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56109","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56109.json","tags":["advisory"]},{"url":"https://github.com/alsa-project/alsa-lib","tags":["package","article"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56109","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0369.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35934","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8044-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8538-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2847","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2848","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2849","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2850","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40573","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56109","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-90781","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40573.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491439","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56109","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","tags":["advisory"]},{"url":"https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","tags":["article"]},{"url":"https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","tags":["article"]},{"url":"https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622291-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268853","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56109","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622381-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622667-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262885-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263270-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263492-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56109","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56109","title":"ALSA Library \u003c 1.2.16.1 Double-Free via parse_def() in conf.c","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T15:58:42.404Z","modified":"2026-11-08T14:05:31.359Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-415"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-38301","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T15:58:42Z","modified":"2026-11-08T14:05:31Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:08.252361Z"}],"ghsa":[{"id":"GHSA-jfrh-w252-q2h4","title":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free...","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T18:34:18Z","modified":"2026-06-22T18:34:23Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:08:56.309175Z"}],"nvd":[{"id":"CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T18:16:48.557Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"BELL-CVE-2026-56109","status":"published","published":"2026-06-24T06:12:59.706028Z","modified":"2026-07-03T07:15:04.542548988Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56109","title":"ALSA Library \u003c 1.2.16.1 Double-Free via parse_def() in conf.c","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T15:58:42.404Z","modified":"2026-11-09T07:04:16.342992357Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-09T03:16:17.543303Z"},{"id":"DEBIAN-CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T18:16:48.557Z","modified":"2026-10-26T11:47:33.530932078Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-2847","title":"alsa-lib security update","description":"The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib\r\n\r\nSecurity Fix(es):\n\nThe Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.912928257Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2848","title":"alsa-lib security update","description":"The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib\r\n\r\nSecurity Fix(es):\n\nThe Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:14.083002075Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2849","title":"alsa-lib security update","description":"The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib\r\n\r\nSecurity Fix(es):\n\nThe Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.910135855Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2850","title":"alsa-lib security update","description":"The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib\r\n\r\nSecurity Fix(es):\n\nThe Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.(CVE-2026-56109)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:14.030416338Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:40573","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-19T10:18:29Z","modified":"2026-09-22T10:42:45.21090767Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-56109","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T18:16:00Z","modified":"2026-07-14T23:30:16.849875627Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90204","title":"CVE-2026-56109 affecting package alsa-lib for versions less than 1.2.16.1-1","description":"The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.","status":"published","published":"2026-06-22T18:16:48Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0369","title":"Updated libalsa2 packages fix security vulnerabilities","description":"alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow.\n(CVE-2026-25068)\nALSA Library \u003c 1.2.16.1 Double-Free via parse_def() in conf.c.\n(CVE-2026-56109)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:00:04.92926149Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21075-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-06-28T08:50:00Z","modified":"2026-06-30T09:15:07.618483539Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-ALPINE-324-CVE-2026-56109","title":"CVE-2026-56109 in alsa-lib - Patched by Root","description":"Root has patched CVE-2026-56109 in the alsa-lib package for Root:Alpine:3.24. Multiple fixed versions available.","status":"published","published":"2026-10-01T11:27:34Z","modified":"2026-10-01T12:15:07.75110157Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"SUSE-SU-2026:22291-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-06-28T08:50:11Z","modified":"2026-06-30T09:15:07.730650473Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22381-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-06-28T08:50:11Z","modified":"2026-07-02T18:24:15.461314565Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22667-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-07-07T11:47:16Z","modified":"2026-07-21T18:48:03.10448085Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2885-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-07-13T10:02:45Z","modified":"2026-07-14T09:15:05.061254914Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3270-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-07-27T11:01:26Z","modified":"2026-07-28T10:00:08.575974321Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3492-1","title":"Security update for alsa","description":"This update for alsa fixes the following issue\n\n- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory\n  (bsc#1268853).\n","status":"published","published":"2026-08-04T11:58:56Z","modified":"2026-08-04T18:30:05.216362449Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8538-1","title":"alsa-lib vulnerability","description":"It was discovered that alsa-lib incorrectly handled certain ALSA\nconfiguration text. An attacker could use this issue to cause alsa-lib to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.","status":"published","published":"2026-07-14T12:02:59Z","modified":"2026-07-14T23:44:42.082995022Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}