Is CVE-2026-90781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90781 being exploited in the wild.

How severe is CVE-2026-90781?

Medium severity, with a CVSS score of 4.4, published 13 September 2026.

Which products and versions are affected?

ALSA Project Alsa-Lib through 1.2.16.1.

Is there a fix for CVE-2026-90781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90781 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-90781?

Check whether you run ALSA Project Alsa-Lib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90781: alsa-lib stack buffer overflow in control element parsing

CVE-2026-90781 · Severity: medium · CVSS 4.4 · Published 2026-09-13

ALSA is the audio system library used by Linux systems to manage sound hardware. A buffer overflow in ALSA's configuration parser allows an attacker to crash audio applications by providing a specially crafted configuration file or command-line argument. While the primary impact is denial of service, such memory corruption could potentially be leveraged for more severe attacks.

Technologies: ALSA Project Alsa-Lib. Vendors: ALSA Project.

Quick answers

Is CVE-2026-90781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90781 being exploited in the wild.
How severe is CVE-2026-90781?: Medium severity, with a CVSS score of 4.4, published 13 September 2026.
Which products and versions are affected?: ALSA Project Alsa-Lib through 1.2.16.1.
Is there a fix for CVE-2026-90781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90781 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-90781?: Check whether you run ALSA Project Alsa-Lib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack-based buffer overflow in the __snd_ctl_ascii_elem_id_parse() function in alsa-lib. The function fails to properly validate the length of a "name=" field when parsing control element identifiers, allowing a 64-byte buffer to be overwritten by one additional byte when a field contains 64 or more characters. An attacker can exploit this by supplying a long control-element identifier string through saved state files or command-line arguments. The overflow overwrites adjacent stack memory, leading to process crashes or potential code execution. The vulnerability is exploitable without authentication on any system running the affected alsa-lib versions.

Affected products

ALSA Project alsa-lib through 1.2.16.1

Timeline

2026-09-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.