ALSA Library CVE-2026-56109

Requires local delivery of attacker-controlled ALSA configuration text to a process linked against vulnerable alsa-lib (<1.2.16.1) - concretely, the ability to write or influence /etc/asound.conf, ~/.asoundrc, any file pulled in via ALSA include/hook directives, or to pass a config string into snd_config_load_string()/snd_config_load(). The configuration must contain nested compound or array blocks crafted so that an inner parse step returns an error, triggering the unchecked path in parse_def(). Limiting factors: AV:L means no network reachability is exposed; exploitation is bounded by file-system permissions on ALSA config locations and by whether the victim process actually parses the attacker-supplied input, and impact per the vendor vector is VI:L/VA:H (crash / memory corruption of the audio-using process), not VC:N confidentiality loss.

Vendor-supplied CVSS 4.0 (7.0, AV:L/AC:L/PR:N/UI:N, VC:N/VI:L/VA:H) reflects a local-only, availability-dominant bug - corrupting audio sessions, not exfiltrating data. Publicly available exploit code raises practical risk for shared-host or multi-tenant Linux systems (kiosks, lab desktops, shared servers, sandbox-escape chains in browsers or container audio passthrough), but the bug is not on CISA KEV and no EPSS score is provided in the input. The realistic priority is moderate: patch promptly on multi-user Linux hosts and anywhere untrusted users can drop an .asoundrc or pass config snippets to alsa-lib, but it is not an internet-facing emergency. Note one tension worth flagging: the input tags this 'Information Disclosure' even though the CVSS metrics set VC:N and the description only documents memory corruption / crash - the 'information disclosure' tag is not corroborated by the vendor vector and should be treated with skepticism until a vendor advisory states otherwise.

An unprivileged local user on a shared Linux host drops a crafted ~/.asoundrc (or a sound application loads attacker-supplied config text) containing a malformed nested compound/array block; when the target process initialises ALSA via snd_config_load(), parse_def() double-frees a node and the process crashes or corrupts adjacent memory. Public exploit material referenced on the alsa-devel mailing list lowers the barrier to reproducing the crash, and the same primitive may be chainable from a browser/audio-passthrough sandbox where attacker-controlled config bytes reach alsa-lib.