alsa-lib CVE-2026-96674

Exploitation requires an application or user running alsa-lib (through 1.2.16.1) to parse an attacker-controlled ALSA topology (.tplg) file through the topology decoder path (tplg_decode_control_mixer / tplg_decode_control_enum / tplg_decode_control_bytes). The attacker must be able to place or supply a crafted topology file, and the victim must load it - this is the UI:P (passive interaction) and AV:L (local) limitation. It is NOT remotely exploitable over the network against a default service; there is no network listener involved. The practical limiting factor is that topology files are normally trusted, system-provided sound-card configuration data, so this only becomes exploitable where alsa-lib processes topology files from an untrusted source.

This is a genuinely low-to-moderate real-world risk despite affecting an extremely widespread library. The CVSS 4.0 base score of 4.8 (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L) is internally consistent with the description: exploitation is local (AV:L) and requires the victim to process an attacker-supplied topology file (UI:P/passive interaction), and the impact is limited to partial information disclosure (VC:L) and application crash / limited availability loss (VA:L), with no integrity impact (VI:N) and no scope change (SC:N). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the intelligence, so this is not confirmed to be under active exploitation - no public exploit identified at time of analysis. The signals do not conflict: a low CVSS, a local-only vector gated on user interaction, and the absence of KEV/EPSS/POC all point the same direction - a real but non-urgent hardening issue rather than a mass-exploitation priority. The main caveat is scale: alsa-lib is present on nearly every Linux audio system, so while individual exploitability is low, the affected population is huge, which is why vendor patching still matters. Note the fix (PR #527) bundles several unrelated hardening changes (path-traversal and assertion fixes) beyond the ctl.c integer overflow described by this CVE - verify the specific commit hunk (ctl.c lines ~1315/1419/1510) maps to this identifier.

An attacker crafts a malicious ALSA topology (.tplg) file in which the mixer/enum/bytes control element size and private-data size fields are set so their 32-bit sum wraps around, defeating the decoder's bounds check. When a local user or an application processing untrusted topology data loads the file via alsa-lib's topology decoder, the decoder reads past the end of the topology buffer, leaking adjacent heap memory or crashing the process. No public exploit code is identified at time of analysis, and exploitation requires the victim to load the crafted file (UI:P).