alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1426 advisory.

    alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer     overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the     num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the     fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value     can cause out-of-bounds heap writes, leading to a crash. (CVE-2026-25068)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8044-1 advisory.

    It was discovered that alsa-lib incorrectly handled the topology mixer control decoder. A local attacker     could use a specially crafted topology file to cause alsa-lib to crash, resulting in a denial of service,     or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the alsa package has been released.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4469 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4469-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Paride Legovini     February 05, 2026                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : alsa-lib     Version        : 1.2.4-1.1+deb11u1     CVE ID         : CVE-2026-25068

    A buffer overflow in the alsa-lib package can lead to a crash when a topology     file (.tplg) has an excessive num_channels value. The alsa-lib package contains     libraries and tools to interface with ALSA, the  Advanced Linux Sound     Architecture.

    For Debian 11 bullseye, this problem has been fixed in version     1.2.4-1.1+deb11u1.

    We recommend that you upgrade your alsa-lib packages.

    For the detailed security status of alsa-lib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/alsa-lib

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer     overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the     num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the     fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value     can cause out-of-bounds heap writes, leading to a crash. (CVE-2026-25068)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
299520	Amazon Linux 2023 : alsa-lib, alsa-lib-devel, alsa-topology (ALAS2023-2026-1426)	Nessus	Amazon Linux Local Security Checks	medium
299339	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : alsa-lib vulnerability (USN-8044-1)	Nessus	Ubuntu Local Security Checks	medium
298944	Photon OS 5.0: Alsa PHSA-2026-5.0-0755	Nessus	PhotonOS Local Security Checks	medium
298464	Photon OS 4.0: Alsa PHSA-2026-4.0-0958	Nessus	PhotonOS Local Security Checks	medium
298163	Debian dla-4469 : libasound2 - security update	Nessus	Debian Local Security Checks	medium
297176	Linux Distros Unpatched Vulnerability : CVE-2026-25068	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25068

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium