Vulnerability in Alsa Project Alsa-Lib
CVE-2026-90781
alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.002 (7.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 7.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020 (patch)
- github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c (technical-description)
- lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@… (mailing-list)
- github.com/alsa-project/alsa-lib (product)
- www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-90781?
- CVE-2026-90781 is a medium-severity vulnerability in Alsa Project Alsa-Lib, classified under Off-by-one Error. CVSS score: 4.4/10. Published 2026-09-13.
- How severe is CVE-2026-90781?
- Medium severity. CVSS v3 base score is 4.4 out of 10.
- Is CVE-2026-90781 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.