CVE-2026-56109
CWE-415Published: June 22, 2026· Updated: Jun 23, 2026
Official Description
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
Technical Analysis
CVE-2026-56109 requires local access, meaning attackers must already have a foothold on the target system.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (4)
Quick Facts
Related CVEs (CWE-415)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-56109 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts