CVE-2026-96674

Name	CVE-2026-96674
Description	alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1148896

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
alsa-lib (PTS)	bookworm	1.2.8-1	vulnerable
	trixie	1.2.14-1+deb13u1	vulnerable
	forky, sid	1.2.16.1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
alsa-lib	source	(unstable)	(unfixed)			1148896

[trixie] - alsa-lib <no-dsa> (Minor issue)
[bookworm] - alsa-lib <postponed> (Minor issue)
https://github.com/alsa-project/alsa-lib/pull/527