Read the docs
TI-2026-20249 Aliases CVE-2026-25068GHSA-x6vq-264g-8wcx

alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow

Priority LOW 21CWE-129Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ALSA Projectalsa-lib1.2.2 – 1.2.15.2—Patch availableCNA
  • alsa-lib VendorALSA Project Affected 1.2.2 – 1.2.15.2 Fixed in — Patch available CNA

Remediation

Red Hat 1 advisory

  • RHSA-2026:7401 Released 2026-04-10 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images alsa-lib-1.2.15.3-3.1.hum1@aarch64, alsa-lib-1.2.15.3-3.1.hum1@src, alsa-lib-1.2.15.3-3.1.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:7401
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25068
  2. 2026-10-03 Alias added: GHSA-x6vq-264g-8wcx

References

Patch 1

  • TI-2019-10031 posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with… CVSS 3.0HIGH 8.1
  • TI-2026-40493 ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c CVSS 4.0HIGH 7.0
  • TI-2009-00035 Link following in alsa-driver CVSS 3.1MEDIUM 5.5
  • TI-2005-00073 The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so… CVSS 2.0MEDIUM 4.6
  • TI-2026-63835 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi CVSS 4.0MEDIUM 4.8
  • TI-2026-63834 alsa-lib through 1.2.16.1 Integer Overflow via Topology File CVSS 4.0MEDIUM 4.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences