CVE-2026-56109
Medium
Description
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
SeverityMedium
CVSS6.8
Exploit probability—
ProductAlsa-project Alsa-lib
PublishedJun 22, 2026
First seenJun 22, 2026
Weakness typeCWE-415CWE-415
How to fix
Update
- alsa-project alsa-lib1.2.16.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alsa-project alsa-lib | v < 1.2.16.1 | 1.2.16.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.