Integer Overflow Vulnerability in alsa-lib by ALSA Project

CVE-2026-96674

What is CVE-2026-96674?

The alsa-lib library up to version 1.2.16.1 contains an integer overflow vulnerability due to inadequate handling of combined topology element size using 32-bit arithmetic. This flaw is present in the source file 'src/topology/ctl.c', where crafted topology files can manipulate size calculations. If exploited, attackers can cause the decoder to read beyond the allocated topology buffer, leading to potential information leakage of sensitive data or application crashes.

References