low3.3
CVE-2026-96675
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access.
Impact
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.
Affected products
| Product | Affected versions |
|---|---|
| Alsa-Lib | through 1.2.16.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.