PT-2026-51365

CVE-2026-56109

Published

2026-06-22

Updated

2026-10-01

Description by

CVSS 4.0

7.0

High

MetricsAV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ALSA library versions prior to 1.2.16.1

Description A double-free issue exists in the parse def() function within src/conf.c. This occurs when the system parses nested compound or array configuration blocks and fails to check return values before proceeding. Consequently, the snd config delete() function is called twice on the same already-freed node, which can lead to memory corruption, a NULL-pointer write, or an invalid memory read if an attacker provides maliciously crafted ALSA configuration text.

Recommendations Update ALSA library to version 1.2.16.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products