CVE-2026-96675

3.3 LOWpublic exploit available

Published 2026-09-23 · Updated 2026-09-24

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-129

Public exploit & PoC references

https://github.com/alsa-project/alsa-lib
https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131
https://github.com/alsa-project/alsa-lib/pull/527

All references

https://github.com/alsa-project/alsa-lib
https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131
https://github.com/alsa-project/alsa-lib/pull/527
https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100654PoC
MEDIUMCVE-2026-100836PoC
UNSCOREDCVE-2026-16651PoC
MEDIUMCVE-2026-17413
HIGHCVE-2026-61695PoC
MEDIUMCVE-2026-62866PoC
MEDIUMCVE-2026-63420PoC
MEDIUMCVE-2026-63635PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.