The vulnerability arises from improper validation of an array index in alsa-lib's topology mixer control decoder. Specifically, the tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without checking it against the fixed-size channel array limit (SND_TPLG_MAX_CHAN). This can cause heap-based buffer overflow due to out-of-bounds writes when a crafted topology file specifies an excessive num_channels value. The affected versions are 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33. The CVSS 4.0 score is 4.6, indicating medium severity with local attack vector and low complexity.

Successful exploitation can cause a heap-based buffer overflow leading to application crashes. The vulnerability requires local access and user interaction (UI:A), with no privileges required. There is no indication of code execution or privilege escalation. No known exploits are currently reported in the wild.

Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users should monitor the ALSA Project for updates or commits addressing this issue, specifically referencing commit 5f7fe33 or later. Until a patch is available, avoid processing untrusted or crafted .tplg topology files to mitigate risk.