CVE-2026-90781

MediumCVSS 4.4/10Last modified Sep 24, 2026

Description

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-193

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ALSA Project	alsa-lib	<= 1.2.16.1

References

Timeline

Published: Sep 13, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-907825.3S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed al CVE-2026-907837.8MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in CVE-2026-907845.3A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compile CVE-2026-907855.3A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/compiler/semantics.c of CVE-2026-907865.3A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/seman CVE-2026-907877.3A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function Registe CVE-2026-907884.7A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the CVE-2026-907897.3A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file CVE-2026-90799.8libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials aroun CVE-2026-907906.3A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the fil CVE-2026-907916.3A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_CVE-2026-907924.3A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.