CVE WatchSep 13, 2026

CVE-2026-90781

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-by

CVSS

4.4

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 13, 2026 · Last modified: Sep 13, 2026 · CWE-193

EPSS · 30d

Not enough EPSS history yet.

Technical description

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-813967.8 HIG

35.3%

——11Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.5d CVE-2026-696095.5 MED

33.2%

——10Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.5d CVE-2026-862978.1 HIG

62.3%

——19A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.5d CVE-2026-81738—

26.1%

——8OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries6d CVE-2026-571605.3 MED

23.2%

——7PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.3d CVE-2026-174695.3 MED

11.0%

——3IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.5d