Executive brief
ALSA is the audio system library used by Linux systems to manage sound hardware. A buffer overflow in ALSA's configuration parser allows an attacker to crash audio applications by providing a specially crafted configuration file or command-line argument. While the primary impact is denial of service, such memory corruption could potentially be leveraged for more severe attacks.
Technical details
The vulnerability is a stack-based buffer overflow in the __snd_ctl_ascii_elem_id_parse() function in alsa-lib. The function fails to properly validate the length of a "name=" field when parsing control element identifiers, allowing a 64-byte buffer to be overwritten by one additional byte when a field contains 64 or more characters. An attacker can exploit this by supplying a long control-element identifier string through saved state files or command-line arguments. The overflow overwrites adjacent stack memory, leading to process crashes or potential code execution. The vulnerability is exploitable without authentication on any system running the affected alsa-lib versions.
Affected products
- ALSA Project alsa-lib through 1.2.16.1
Timeline
- 2026-09-13: disclosed