Skip to content
OpenAdvisories
Medium USN-8044-1 1 CVE

alsa-lib vulnerability

Published Feb 16, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that alsa-lib incorrectly handled the topology mixer
control decoder. A local attacker could use a specially crafted topology
file to cause alsa-lib to crash, resulting in a denial of service, or
possibly execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS alsa-lib 1.2.6.1-1ubuntu1.1
Ubuntu · 24.04 LTS 24.04:LTS alsa-lib 1.2.11-1ubuntu0.2
Ubuntu · 25.10 alsa-lib 1.2.14-1ubuntu1.1

Vulnerabilities 1

  • Medium 4.6
    CVE-2026-25068

    alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow

    alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and use…

    alsa-project alsa-lib alsa-lib alsa-lib Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-25068