CVE catalog

CVE-2026-25068

alsa-lib vulnerability

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianalsa-libsid1.2.16.1-2fixed
Debianalsa-libforky1.2.16.1-2fixed
Debianalsa-libtrixie1.2.14-1+deb13u1fixed
Debianalsa-libbookworm1.2.8-1vulnerable
Ubuntualsa-libnobleNot reportedvulnerable
Ubuntualsa-libnoble1.2.11-1ubuntu0.2fixed
Ubuntulibasound2-datanoble1.2.11-1ubuntu0.2fixed
Ubuntulibasound2-devnoble1.2.11-1ubuntu0.2fixed
Ubuntulibasound2-docnoble1.2.11-1ubuntu0.2fixed
Ubuntulibasound2-plugin-smixernoble1.2.11-1ubuntu0.2fixed
Ubuntulibasound2t64noble1.2.11-1ubuntu0.2fixed
Ubuntulibatopology-devnoble1.2.11-1ubuntu0.2fixed
Ubuntulibatopology2t64noble1.2.11-1ubuntu0.2fixed
Ubuntualsa-libpro1.1.9-0ubuntu1vulnerable
Ubuntualsa-libpro1.2.1.2-2ubuntu2vulnerable
Ubuntualsa-libpro1.2.2-2ubuntu1vulnerable
Ubuntualsa-libpro1.2.2-2.1vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu1vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.1vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.2vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.3vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.4vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.5vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.5+esm1fixed
Ubuntualsa-libpro1.1.9-0ubuntu1vulnerable
Ubuntualsa-libpro1.2.1.2-2ubuntu2vulnerable
Ubuntualsa-libpro1.2.2-2ubuntu1vulnerable
Ubuntualsa-libpro1.2.2-2.1vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu1vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.1vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.2vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.3vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.4vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.5vulnerable
Ubuntualsa-libpro1.2.2-2.1ubuntu2.5+esm1fixed
Ubuntualsa-lib22.041.2.4-1.1ubuntu3vulnerable
Ubuntualsa-lib22.041.2.4-1.1ubuntu4vulnerable
Ubuntualsa-lib22.041.2.5.1-1ubuntu1vulnerable
Ubuntualsa-lib22.041.2.6.1-1ubuntu1vulnerable
Ubuntualsa-lib22.041.2.6.1-1ubuntu1.1fixed
Ubuntualsa-lib24.041.2.9-2vulnerable
Ubuntualsa-lib24.041.2.10-1vulnerable
Ubuntualsa-lib24.041.2.10-2vulnerable
Ubuntualsa-lib24.041.2.10-3vulnerable
Ubuntualsa-lib24.041.2.10-3build1vulnerable
Ubuntualsa-lib24.041.2.11-1build1vulnerable
Ubuntualsa-lib24.041.2.11-1build2vulnerable
Ubuntualsa-lib24.041.2.11-1ubuntu0.1vulnerable
Ubuntualsa-lib24.041.2.11-1ubuntu0.2fixed
Ubuntualsa-lib25.101.2.13-1build1vulnerable
Ubuntualsa-lib25.101.2.14-1vulnerable
Ubuntualsa-lib25.101.2.14-1ubuntu1vulnerable
Ubuntualsa-lib25.101.2.14-1ubuntu1.1fixed
Ubuntualsa-lib26.041.2.14-1ubuntu1vulnerable
Ubuntualsa-lib26.041.2.14-2ubuntu1vulnerable
Ubuntualsa-lib26.041.2.15-2vulnerable
Ubuntualsa-lib26.041.2.15.1-1vulnerable
Ubuntualsa-lib26.041.2.15.3-1vulnerable
Ubuntualsa-lib26.041.2.15.3-1build1vulnerable
Ubuntualsa-lib26.041.2.15.3-1ubuntu1fixed
Ubuntualsa-lib22.041.2.4-1.1ubuntu3vulnerable
Ubuntualsa-lib22.041.2.4-1.1ubuntu4vulnerable
Ubuntualsa-lib22.041.2.5.1-1ubuntu1vulnerable
Ubuntualsa-lib22.041.2.6.1-1ubuntu1vulnerable
Ubuntualsa-lib22.041.2.6.1-1ubuntu1.1fixed
Ubuntualsa-lib24.041.2.9-2vulnerable
Ubuntualsa-lib24.041.2.10-1vulnerable
Ubuntualsa-lib24.041.2.10-2vulnerable
Ubuntualsa-lib24.041.2.10-3vulnerable
Ubuntualsa-lib24.041.2.10-3build1vulnerable
Ubuntualsa-lib24.041.2.11-1build1vulnerable
Ubuntualsa-lib24.041.2.11-1build2vulnerable
Ubuntualsa-lib24.041.2.11-1ubuntu0.1vulnerable
Ubuntualsa-lib24.041.2.11-1ubuntu0.2fixed
Ubuntualsa-lib25.101.2.13-1build1vulnerable
Ubuntualsa-lib25.101.2.14-1vulnerable
Ubuntualsa-lib25.101.2.14-1ubuntu1vulnerable
Ubuntualsa-lib25.101.2.14-1ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianalsa-libsourcesid1.2.16-1not yet assignedNot reported[1126629]
Debianalsa-libsourceforky1.2.16-1not yet assignedNot reported[1126629]
Debianalsa-libsourcetrixie1.2.14-1+deb13u1not yet assignedNot reported[1126629]
Debianalsa-libsourcebookworm(unfixed)not yet assignedNot reported[1126629]
Ubuntualsa-libdebnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibasound2-datadebnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibasound2-devdebnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibasound2-docdebnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibasound2-plugin-smixerdebnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibasound2t64debnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibatopology-devdebnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibatopology2t64debnoble1.2.11-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntualsa-libdebpro1.2.2-2.1ubuntu2.5+esm1Not reportedUSN-8044-2Not reported
Ubuntualsa-libdebpro1.2.2-2.1ubuntu2.5+esm1Not reportedUBUNTU-CVE-2026-25068Not reported
Ubuntualsa-libdeb22.041.2.6.1-1ubuntu1.1Not reportedUBUNTU-CVE-2026-25068Not reported
Ubuntualsa-libdeb24.041.2.11-1ubuntu0.2Not reportedUBUNTU-CVE-2026-25068Not reported
Ubuntualsa-libdeb25.101.2.14-1ubuntu1.1Not reportedUBUNTU-CVE-2026-25068Not reported
Ubuntualsa-libdeb26.041.2.15.3-1ubuntu1Not reportedUBUNTU-CVE-2026-25068Not reported
Ubuntualsa-libdeb22.041.2.6.1-1ubuntu1.1Not reportedUSN-8044-1Not reported
Ubuntualsa-libdeb24.041.2.11-1ubuntu0.2Not reportedUSN-8044-1Not reported
Ubuntualsa-libdeb25.101.2.14-1ubuntu1.1Not reportedUSN-8044-1Not reported

[Debian bug #1126629]

Notes

[bookworm] alsa-lib: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libasound2]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1+b1 · amd64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1+b1 · arm64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

  • [libasound2-data]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1 · all · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1 · all · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

  • [libasound2-dev]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1+b1 · amd64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1+b1 · arm64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

  • [libasound2-doc]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1 · all · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1 · all · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

  • [libasound2-plugin-smixer]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1+b1 · amd64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1+b1 · arm64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

  • [libatopology2]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1+b1 · amd64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1+b1 · arm64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

  • [libatopology-dev]Affected

    Source package: [alsa-lib]

    Details (2)

    • 1.2.8-1+b1 · amd64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

    • 1.2.8-1+b1 · arm64 · bookworm

      Affected

      usn · alsa-lib · debian · bookworm; usn · alsa-lib · debian · 12

[Debian 13 (Trixie)]

  • [libasound2-data]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · all · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · all · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

  • [libasound2-dev]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · amd64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · arm64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

  • [libasound2-doc]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · all · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · all · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

  • [libasound2-plugin-smixer]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · amd64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · arm64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

  • [libasound2t64]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · amd64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · arm64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

  • [libatopology2t64]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · amd64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · arm64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

  • [libatopology-dev]Affected

    Source package: [alsa-lib]

    Details (4)

    • 1.2.14-1 · amd64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.14-1 · arm64 · trixie

      Affected · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

    • 1.2.16.1-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 1.2.14-1+deb13u1

      usn · alsa-lib · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]