CVE-2026-90781: alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()
alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
A local attacker with low privileges who can cause a program using alsa-lib to parse a control-element identifier can trigger it. Relevant input paths include saved state files and command-line arguments.
What input triggers the overflow?
The vulnerable parser is triggered by a name= field containing 64 or more characters. It writes one byte past a 64-byte stack buffer while parsing that field.
What is the practical impact?
The overflow can overwrite adjacent stack memory and crash the calling process. The supplied severity vector indicates low integrity and availability impact, with no confidentiality impact.
What can be done if an update cannot be applied immediately?
Do not allow untrusted saved state files or command-line control-element identifiers to reach the parser. Ensure name= values are shorter than 64 characters where those inputs must be accepted.
How can I determine whether software is in scope?
Systems using ALSA Project alsa-lib through version 1.2.16.1 are affected when they invoke __snd_ctl_ascii_elem_id_parse() on control-element identifier input. Check whether local workflows parse saved state files or accept such identifiers through command-line arguments.