Read the docs
TI-2026-40493 Aliases CVE-2026-56109GHSA-jfrh-w252-q2h4

ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c

Priority LOW 30CWE-415Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial alsa-lib (alsa-project): 1.2.16.1Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ALSA Projectalsa-libbefore 1.2.16.11.2.16.1Patch availableCNA
  • alsa-lib VendorALSA Project Affected before 1.2.16.1 Fixed in 1.2.16.1 Patch available CNA

Remediation

  • Fix · CNA alsa-lib (alsa-project) Fixed in 1.2.16.1

Red Hat 1 advisory

  • RHSA-2026:40573 Released 2026-07-16 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images alsa-lib-1.2.16.1-2.hum1@aarch64, alsa-lib-1.2.16.1-2.hum1@src, alsa-lib-1.2.16.1-2.hum1@x86_64 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:40573

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56109
  2. 2026-10-03 Alias added: GHSA-jfrh-w252-q2h4

References

Exploit 1

Patch 1

Other 1

  • TI-2019-10031 posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with… CVSS 3.0HIGH 8.1
  • TI-2009-00035 Link following in alsa-driver CVSS 3.1MEDIUM 5.5
  • TI-2005-00073 The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so… CVSS 2.0MEDIUM 4.6
  • TI-2026-63835 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi CVSS 4.0MEDIUM 4.8
  • TI-2026-63834 alsa-lib through 1.2.16.1 Integer Overflow via Topology File CVSS 4.0MEDIUM 4.8
  • TI-2026-61688 alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse() CVSS 4.0MEDIUM 4.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences