CVE-2026-96675
Low
Description
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.
SeverityLow
CVSS3.3
Exploit probability—
Product
Microsoft Azl3 Alsa-lib
PublishedSep 23, 2026
First seenSep 23, 2026
Weakness typeCWE-129CWE-129
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft azl3_alsa-lib_1.2.16.1-1 | No range specified | — |
| microsoft azl3_alsa-lib_1.2.16.1-3 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.