Description

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-13T13:16:29.263Z",
  "pubdate": "2026-09-13T13:16:29.263Z",
  "executiveSummary": "The alsa-lib library, specifically versions through 1.2.16.1, is susceptible to a stack-based buffer overflow vulnerability within the __snd_ctl_ascii_elem_id_parse() function.\nThe vulnerability arises due to an off-by-one error when processing control-element identifiers, specifically during the parsing of the 'name=' field.\nBy providing a crafted identifier string exceeding 64 characters, an attacker can trigger an out-of-bounds write of one byte onto the stack memory of the calling process.\nThis flaw may lead to memory corruption, resulting in process instability or application crashes.\nThe vulnerability is exploitable via vectors such as malicious saved state files or manipulated command-line arguments that utilize alsa-lib functionalities.\nWhile primarily causing denial-of-service, stack-based corruption often presents broader security risks, including potential code execution depending on the compiler's stack protection mechanisms and the specific memory layout of the host process.",
  "technicalDetails": "The root cause of the vulnerability resides in the __snd_ctl_ascii_elem_id_parse() function within alsa-lib. The function allocates a fixed 64-byte stack buffer to store the parsed name component of a control-element identifier.\nThe vulnerability manifests during the string parsing routine: when the 'name=' field in an identifier string equals or exceeds 64 characters in length, the bounds checking logic fails to account for the null-terminator, resulting in a single-byte overflow beyond the allocated stack buffer.\nThe attack flow begins when an attacker supplies a malformed input containing an oversized identifier string. This input can be provided via interfaces that invoke __snd_ctl_ascii_elem_id_parse(), such as loading a maliciously crafted ALSA state file or passing specific arguments through command-line utilities that interact with the sound subsystem.\nUpon processing the 'name=' field, the parser copies the attacker-controlled input into the destination buffer on the stack. The off-by-one write occurs when the function appends the null-terminator byte to the 65th position of the 64-byte destination buffer.\nThis overwrite directly impacts adjacent memory locations on the stack. In typical binary environments, this may corrupt the saved frame pointer (EBP/RBP) or other return addresses and local variables, depending on the compiler's stack layout and alignment padding.\nThe impact is primarily a crash of the calling process due to the corruption of stack integrity, which triggers a segmentation fault or a stack canary mismatch if the system employs ProPolice or similar stack protection techniques.\nSuccessful exploitation requires the attacker to have the ability to influence the input processed by the library. No specific authentication is required, as the vulnerability is triggered locally through file inputs or process arguments. The exposure is local, limited to processes linked against the vulnerable alsa-lib implementation.\nPost-exploitation behavior following the crash includes the termination of the service or application. While the current impact is defined as a crash, such overflows are often the first step in more sophisticated arbitrary code execution chains if the stack frame can be manipulated to redirect control flow."
}