# CVE-2026-90781: alsa-lib stack buffer overflow in control element parsing

Source: https://junglewise.ai/threats/cve-2026-90781-alsa-lib-stack-buffer-overflow-in-control-element-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90781 · Severity: medium · CVSS 4.4 · Published 2026-09-13

ALSA is the audio system library used by Linux systems to manage sound hardware. A buffer overflow in ALSA's configuration parser allows an attacker to crash audio applications by providing a specially crafted configuration file or command-line argument. While the primary impact is denial of service, such memory corruption could potentially be leveraged for more severe attacks.

Technologies: [ALSA Project Alsa-Lib](https://junglewise.ai/threats/technologies/alsa-lib). Vendors: [ALSA Project](https://junglewise.ai/threats/vendors/alsa-project).

## Quick answers

**Is CVE-2026-90781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90781 being exploited in the wild.

**How severe is CVE-2026-90781?** Medium severity, with a CVSS score of 4.4, published 13 September 2026.

**Which products and versions are affected?** ALSA Project Alsa-Lib through 1.2.16.1.

**Is there a fix for CVE-2026-90781?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90781 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-90781?** Check whether you run ALSA Project Alsa-Lib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack-based buffer overflow in the __snd_ctl_ascii_elem_id_parse() function in alsa-lib. The function fails to properly validate the length of a "name=" field when parsing control element identifiers, allowing a 64-byte buffer to be overwritten by one additional byte when a field contains 64 or more characters. An attacker can exploit this by supplying a long control-element identifier string through saved state files or command-line arguments. The overflow overwrites adjacent stack memory, leading to process crashes or potential code execution. The vulnerability is exploitable without authentication on any system running the affected alsa-lib versions.

## Affected products

- ALSA Project alsa-lib through 1.2.16.1

## Timeline

- 2026-09-13: disclosed

## References

- [https://github.com/alsa-project/alsa-lib](https://github.com/alsa-project/alsa-lib)
- [https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c](https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c)

## Related threats

- [alsa-lib integer overflow in topology element size computation](https://junglewise.ai/threats/cve-2026-96674-alsa-lib-through-1-2-16-1-computes-combined-topology-element-size)
- [ALSA alsa-lib double free in parse_def configuration parser](https://junglewise.ai/threats/cve-2026-56109-alsa-alsa-lib-double-free-in-parse-def-configuration-parser)