CVE-2026-96675: alsa-lib through 1.2.16.1 Denial of Service via pcm_multi
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using alsa-lib through 1.2.16.1 that load an attacker-controlled or otherwise untrusted ALSA configuration file are exposed. The impact is limited to application availability because successful exploitation causes the application to abort.
What does an attacker need to exploit it?
The attacker needs the ability to supply a malicious ALSA configuration containing sparse bindings for the multi PCM plugin. The vector requires local access and low privileges; no user interaction is required.
What can be done if updating alsa-lib is not immediately possible?
Do not load ALSA configuration files from untrusted sources, and restrict who can modify configuration files used by affected applications. Avoid or disable use of the multi PCM plugin with sparse bindings where operationally feasible.