PT-2026-51365 · Alsa · Alsa-Lib

Dmitrijs Trizna + 3 · Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-56109

NVD

CVSS v3.1

6.8

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse def() fails to check return values before continuing, causing snd config delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.

Exploit

Correção

Double Free

Enumeração de Fraquezas

CWE-415

Identificadores relacionados

CVE-2026-56109

Produtos afetados

Alsa-Lib

Referências · 5

• 🔥 https://lore.kernel.org/alsa-devel/[e-mail] · Exploit
• https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0 · Correção
• https://vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c · Nota
• https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56109 · Nota de Segurança