Skip to content
OpenAdvisories
Medium USN-8044-2 1 CVE

alsa-lib vulnerability

Published Jun 9, 2026 · Updated Jun 9, 2026

Ecosystem: Ubuntu

Summary

USN-8044-1 fixed a vulnerability in alsa-lib. This update provides the
corresponding fix for alsa-lib on Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that alsa-lib incorrectly handled the topology mixer
control decoder. A local attacker could use a specially crafted topology
file to cause alsa-lib to crash, resulting in a denial of service, or
possibly execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS alsa-lib 1.2.2-2.1ubuntu2.5+esm1

Vulnerabilities 1

  • Medium 4.6
    CVE-2026-25068

    alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow

    alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and use…

    alsa-project alsa-lib alsa-lib alsa-lib Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-25068