Skip to main content

ALSA Library CVE-2026-56109

| EUVDEUVD-2026-38301 HIGH
Double Free (CWE-415)
2026-06-22 VulnCheck GHSA-jfrh-w252-q2h4
Information Disclosure Red Hat Alsa Lib Alsa Project
7.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.0 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Local-only via ALSA config text (AV:L); any local user can stage a config (PR:N) but a victim process must load it (UI:R); impact is crash/memory corruption, not disclosure (C:N, I:L, A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
6.8 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 17:52 vuln.today
Analysis Generated
Jun 22, 2026 - 17:52 vuln.today
CVE Published
Jun 22, 2026 - 15:58 cve.org
HIGH 7.0

DescriptionCVE.org

The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.

AnalysisAI

Memory corruption in the Advanced Linux Sound Architecture (ALSA) user-space library (alsa-lib) before 1.2.16.1 allows local attackers to crash audio-dependent processes by feeding maliciously crafted configuration text to parse_def() in src/conf.c. The flaw is a double-free reachable through nested compound or array config blocks, leading to a NULL-pointer write or invalid read; publicly available exploit code exists (reported by VulnCheck), but the issue is not on the CISA KEV list.

Technical ContextAI

alsa-lib is the user-space companion to the Linux kernel's ALSA subsystem and is dynamically loaded by virtually every Linux audio client (PulseAudio, PipeWire, mpv, browsers, games) to parse /etc/asound.conf, ~/.asoundrc and additional include files. The root cause is a classic CWE-415 (Double Free): parse_def() recurses into nested compound/array blocks but did not check the return value of an inner call before continuing, so on certain error paths snd_config_delete() runs twice against the same already-freed snd_config_t node. The upstream commit 536dd6f8 fixes it by inserting an if (c < 0) { err = c; goto __end; } guard so the failed sub-parse aborts before the duplicate free. The affected CPE is cpe:2.3:a:alsa-project:alsa-lib:*:*:*:*:*:*:*:* up to versions prior to 1.2.16.1.

RemediationAI

Vendor-released patch: upgrade to alsa-lib 1.2.16.1 or later (release at https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1, fix commit https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0); track your distribution's security feed and apply the corresponding alsa-lib / libasound2 package. Where immediate patching is not possible, restrict who can write /etc/asound.conf, per-user ~/.asoundrc and any directories pulled in via ALSA's include directives, and avoid feeding untrusted configuration text through applications that call snd_config_load*() - note that locking these files breaks legitimate per-user audio customisation and may surprise desktop users. Sandboxing audio-consuming processes (seccomp, systemd hardening, Flatpak/Snap confinement, browser sandboxes) further limits the blast radius of a triggered crash.

More in Alsa Lib

View all
CVE-2026-90781 MEDIUM
4.8 Sep 13

Stack buffer overflow in alsa-lib through 1.2.16.1 allows local low-privilege attackers to crash any process consuming A

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-56109 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy