PT-2026-5330 · Alsa-Lib+2 · Alsa-Lib+2

Sajeeb Lohani + 1 · Published 2026-01-01 · Updated 2026-03-15 · CVE-2026-25068

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions alsa-lib versions 1.2.2 through 1.2.15.2

Description alsa-lib contains a heap-based buffer overflow in the topology mixer control decoder. The tplg decode control mixer1() function reads the num channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array SND TPLG MAX CHAN. A crafted topology file with an excessive num channels value can cause out-of-bounds heap writes, leading to a crash.

Recommendations Update to a version of alsa-lib after commit 5f7fe33.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

AZL-75773

AZL-76295

BDU:2026-06708

CVE-2026-25068

ECHO-EC6A-FA2D-8CAB

OESA-2026-1582

RHSA-2026:7401

USN-8044-1

Affected Products

Linuxmint

Ubuntu

Alsa-Lib

References · 26

• https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40 · Patch
• https://osv.dev/vulnerability/OESA-2026-1582 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25068 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25068 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25068 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25068 · Security Note
• https://bdu.fstec.ru/vul/2026-06708 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25068 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25068 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76295 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-25068 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25068 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75773 · Vendor Advisory