Threats affecting pkg:github/alsa-project/alsa-lib

A denial of service vulnerability exists in alsa-lib through version 1.2.16.1 in the multi PCM plugin due to improper validation of sparse binding indices before array access. This can cause an out-of-bounds array read and assertion failure, leading to application abort when processing a malicious ALSA configuration file.

An integer overflow or wraparound vulnerability exists in alsa-lib through version 1.2.16.1. The issue occurs in the computation of combined topology element size using 32-bit arithmetic, which allows crafted topology files to bypass bounds checks. This can lead to reading beyond the intended buffer, potentially causing application crashes or leakage of sensitive data.

CVE-2026-90781 is a medium severity vulnerability in alsa-lib, a library interfacing with ALSA in the Linux kernel. It involves a stack buffer overflow caused by an off-by-one error in the __snd_ctl_ascii_elem_id_parse() function when parsing a name= field with 64 or more characters. This overflow allows overwriting one byte past a 64-byte buffer, potentially crashing the calling process. The flaw affects alsa-lib versions up to and including 1.2.16.1.

The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.