An update for alsa-lib is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-1582 Final 1.0 1.0 2026-03-15 Initial 2026-03-15 2026-03-15 openEuler SA Tool V1.0 2026-03-15 alsa-lib security update An update for alsa-lib is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3 The alsa-lib is a library to interface with ALSA in the Linux kernel and virtual devices using a plugin system. More detail: https://alsa.opensrc.org/Alsa-lib Security Fix(es): alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.(CVE-2026-25068) An update for alsa-lib is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium alsa-lib https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1582 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-25068 https://nvd.nist.gov/vuln/detail/CVE-2026-25068 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 alsa-lib-1.2.3-2.oe2003sp4.x86_64.rpm alsa-lib-debuginfo-1.2.3-2.oe2003sp4.x86_64.rpm alsa-lib-debugsource-1.2.3-2.oe2003sp4.x86_64.rpm alsa-lib-devel-1.2.3-2.oe2003sp4.x86_64.rpm alsa-lib-1.2.5.1-4.oe2203sp4.x86_64.rpm alsa-lib-debuginfo-1.2.5.1-4.oe2203sp4.x86_64.rpm alsa-lib-debugsource-1.2.5.1-4.oe2203sp4.x86_64.rpm alsa-lib-devel-1.2.5.1-4.oe2203sp4.x86_64.rpm alsa-lib-1.2.10-4.oe2403.x86_64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403.x86_64.rpm alsa-lib-debugsource-1.2.10-4.oe2403.x86_64.rpm alsa-lib-devel-1.2.10-4.oe2403.x86_64.rpm alsa-lib-1.2.10-4.oe2403sp1.x86_64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403sp1.x86_64.rpm alsa-lib-debugsource-1.2.10-4.oe2403sp1.x86_64.rpm alsa-lib-devel-1.2.10-4.oe2403sp1.x86_64.rpm alsa-lib-1.2.10-4.oe2403sp2.x86_64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403sp2.x86_64.rpm alsa-lib-debugsource-1.2.10-4.oe2403sp2.x86_64.rpm alsa-lib-devel-1.2.10-4.oe2403sp2.x86_64.rpm alsa-lib-1.2.10-4.oe2403sp3.x86_64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403sp3.x86_64.rpm alsa-lib-debugsource-1.2.10-4.oe2403sp3.x86_64.rpm alsa-lib-devel-1.2.10-4.oe2403sp3.x86_64.rpm alsa-topology-1.2.3-2.oe2003sp4.noarch.rpm alsa-ucm-1.2.3-2.oe2003sp4.noarch.rpm alsa-topology-1.2.5.1-4.oe2203sp4.noarch.rpm alsa-ucm-1.2.5.1-4.oe2203sp4.noarch.rpm alsa-topology-1.2.10-4.oe2403.noarch.rpm alsa-ucm-1.2.10-4.oe2403.noarch.rpm alsa-topology-1.2.10-4.oe2403sp1.noarch.rpm alsa-ucm-1.2.10-4.oe2403sp1.noarch.rpm alsa-topology-1.2.10-4.oe2403sp2.noarch.rpm alsa-ucm-1.2.10-4.oe2403sp2.noarch.rpm alsa-topology-1.2.10-4.oe2403sp3.noarch.rpm alsa-ucm-1.2.10-4.oe2403sp3.noarch.rpm alsa-lib-1.2.3-2.oe2003sp4.aarch64.rpm alsa-lib-debuginfo-1.2.3-2.oe2003sp4.aarch64.rpm alsa-lib-debugsource-1.2.3-2.oe2003sp4.aarch64.rpm alsa-lib-devel-1.2.3-2.oe2003sp4.aarch64.rpm alsa-lib-1.2.5.1-4.oe2203sp4.aarch64.rpm alsa-lib-debuginfo-1.2.5.1-4.oe2203sp4.aarch64.rpm alsa-lib-debugsource-1.2.5.1-4.oe2203sp4.aarch64.rpm alsa-lib-devel-1.2.5.1-4.oe2203sp4.aarch64.rpm alsa-lib-1.2.10-4.oe2403.aarch64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403.aarch64.rpm alsa-lib-debugsource-1.2.10-4.oe2403.aarch64.rpm alsa-lib-devel-1.2.10-4.oe2403.aarch64.rpm alsa-lib-1.2.10-4.oe2403sp1.aarch64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403sp1.aarch64.rpm alsa-lib-debugsource-1.2.10-4.oe2403sp1.aarch64.rpm alsa-lib-devel-1.2.10-4.oe2403sp1.aarch64.rpm alsa-lib-1.2.10-4.oe2403sp2.aarch64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403sp2.aarch64.rpm alsa-lib-debugsource-1.2.10-4.oe2403sp2.aarch64.rpm alsa-lib-devel-1.2.10-4.oe2403sp2.aarch64.rpm alsa-lib-1.2.10-4.oe2403sp3.aarch64.rpm alsa-lib-debuginfo-1.2.10-4.oe2403sp3.aarch64.rpm alsa-lib-debugsource-1.2.10-4.oe2403sp3.aarch64.rpm alsa-lib-devel-1.2.10-4.oe2403sp3.aarch64.rpm alsa-lib-1.2.3-2.oe2003sp4.src.rpm alsa-lib-1.2.5.1-4.oe2203sp4.src.rpm alsa-lib-1.2.10-4.oe2403.src.rpm alsa-lib-1.2.10-4.oe2403sp1.src.rpm alsa-lib-1.2.10-4.oe2403sp2.src.rpm alsa-lib-1.2.10-4.oe2403sp3.src.rpm alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash. 2026-03-15 CVE-2026-25068 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L alsa-lib security update 2026-03-15 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1582