The ALSA Project's alsa-lib library through version 1.2.16.1 contains a stack buffer overflow due to an off-by-one error in the __snd_ctl_ascii_elem_id_parse() function. When parsing control-element identifier strings with 64 or more characters in the name= field, the function writes one byte beyond the allocated 64-byte buffer. This vulnerability can be triggered by supplying a long identifier string via saved state files or command-line arguments, resulting in adjacent stack memory overwrite and process crash.

This vulnerability allows local attackers with the ability to supply long control-element identifier strings to cause a stack buffer overflow, potentially crashing the affected process. The CVSS score of 4.8 (medium severity) reflects limited attack vector (local), low privileges required, and no known remote exploitation or privilege escalation. There are no known exploits in the wild.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid supplying control-element identifier strings with 64 or more characters to the alsa-lib functions. Monitor vendor communications for updates.