Skip to content
OpenAdvisories
Medium USN-8538-1 1 CVE

alsa-lib vulnerability

Published Jul 14, 2026 · Updated Jul 14, 2026

Ecosystem: Ubuntu

Summary

It was discovered that alsa-lib incorrectly handled certain ALSA
configuration text. An attacker could use this issue to cause alsa-lib to
crash, resulting in a denial of service, or possibly execute arbitrary
code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS alsa-lib 1.2.6.1-1ubuntu1.2
Ubuntu · 24.04 LTS 24.04:LTS alsa-lib 1.2.11-1ubuntu0.3
Ubuntu · 26.04 LTS 26.04:LTS alsa-lib 1.2.15.3-1ubuntu1.1

Vulnerabilities 1

  • Medium 6.8
    CVE-2026-56109

    ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c

    The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compou…

    alsa-project alsa-lib alsa-lib alsa-lib Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-56109