CVE-2026-90781

Name of the Vulnerable Software and Affected Versions alsa-lib versions prior to 1.2.16.1

Description A stack buffer overflow exists in the snd ctl ascii elem id parse() function. The issue is caused by an off-by-one error that writes one byte beyond a 64-byte buffer when parsing a name= field containing 64 or more characters. An attacker can trigger this by providing a long control-element identifier string via command-line arguments or saved state files, leading to the overwriting of adjacent stack memory and a crash of the calling process, resulting in a denial of service.

Recommendations Update to version 1.2.16.1 or later.