The multi PCM plugin in alsa-lib up to and including version 1.2.16.1 allows an out‑of‑bounds array read when sparse binding indices are not validated before use. A malicious ALSA configuration file can trigger this read, causing an assertion failure that aborts the application. This leads to a denial of service, disrupting audio services or any application that relies on alsa-lib.

The vulnerability affects the ALSA Project’s alsa-lib package, specifically all releases up to and including 1.2.16.1. Systems that deploy this library without patching, either directly or through packaged distributions, are at risk.

The CVSS score is 4.8, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting a low to moderate likelihood of exploitation in the wild. The attack vector is inferred to be local; an attacker must supply a crafted ALSA configuration file that the library processes. If an application loads configuration files from network or other untrusted sources, the risk may extend to remote exploitation, but the description does not explicitly state such a scenario.