The vulnerability arises from a 32-bit arithmetic overflow in the calculation of combined topology element sizes within alsa-lib. When a crafted topology file is processed, the overflow defeats bounds checks and causes the decoder to read beyond the topology buffer, which can result in sensitive data being exposed or the application terminating unexpectedly. This is a classic integer overflow flaw (CWE-190) with a CVSS base score of 4.8, indicating moderate severity.

The flaw affects the ALSA Project’s ALSA library versions up to and including 1.2.16.1, which are deployed on many Linux‑based systems. Any system that loads topology files from this library while the vulnerable version is present is potentially exposed.

The CVSS score of 4.8 places the vulnerability in the moderate range, and the EPSS score is currently not available, so the exact exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, but the attack requires the ability to supply a malicious topology file, typically by a local or privileged user. An attacker could trigger data leakage or a denial‑of‑service condition by causing the ALSA processor to read beyond the intended memory bounds.