CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93808 ALSA: usb-audio: caiaq: validate EP1 reply lengths

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

EUVD-2026-86152

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Audio in Google Chrome before version 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

CVE-2026-96774

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.320181106 Build 107. This affects the function loadCfg of the file /ini/syscfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched...

CVE-2026-96774 SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.320181106 Build 107. This affects the function loadCfg of the file /ini/syscfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched...

EUVD-2026-85761

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.320181106 Build 107. This affects the function loadCfg of the file /ini/syscfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched...

CVE-2026-96774 SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.320181106 Build 107. This affects the function loadCfg of the file /ini/syscfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched...

CVE-2026-96774

A vulnerability exists in the SPON Communications IP Network Audio Device XC-9603 (version 1.2.3_20181106 Build 107). The flaw impacts the loadCfg function within the /ini/sys_cfg.txt file of the Configuration File Download component. This issue allows for information disclosure via a remote atta...

CVE-2026-96774: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.320181106 Build 107. This affects the function loadCfg of the file /ini/syscfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched...

PT-2026-97645

Name of the Vulnerable Software and Affected Versions SPON Communications IP Network Audio Device XC-9603 version 1.2.3 20181106 Build 107 Description A remote information disclosure issue exists within the Configuration File Download component. The flaw is located in the loadCfg function when...

AEGIS: Audio Endogenous Guarding Via Internal Signals against Large Audio-Language Model Jailbreaks

Large audio-language models LALMs expand language models to process and interpret audio, but also expose them to heterogeneous audio jailbreaks. We ask whether successful jailbreaks reflect failures to recognize harmful intent or failures occurring after such recognition. Layer-wise probing revea...

ROS-20260924-73-0025

The vulnerability of the sndcardymfpciprobe function in the sound/pci/ymfpci/ymfpci.c module of the Linux kernel’s audio subsystem is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-98008

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA usb-audio caiaq component where the usb ep1 command reply dispatch function fails to verify that the urb-actual length contains the necessary bytes before...

CVE-2026-93808

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...