In alsa-lib versions 1.2.2 through 1.2.15.2, the topology mixer control decoder reads a channel count field from an untrusted .tplg file and uses it as a loop bound without validating it against the library’s fixed-size channel array. This missing bounds check leads to a heap‑based buffer overflow that can overwrite adjacent memory and crash the process. The vulnerability causes loss of service because it terminates the ALSA control daemon. It does not provide an attacker with privilege escalation or remote code execution.

ALSA Project alsa-lib, versions 1.2.2 to and including 1.2.15.2. The issue was fixed in commit 5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40 and any releases derived from that commit.

The CVSS score of 4.6 reflects moderate severity; the EPSS score of < 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted topology file that is processed by the ALSA control subsystem, typically via local user actions or by compromising a process that loads custom topology data. The absence of network‑exposed triggers means the attack vector is local and dependent on file handling privileges.