Y2
Public vulnerability disclosure

CVE-2026-14330

Pipewire: pulse server alloca stack overflow

publishedCWE-770

Multiple unbounded alloca() calls in the PulseAudio protocol server.

Investigate in Cyber JSONMarkdown
Technical severity5.5 mediumCVSS 3.1 · CNA: redhat
Published2026-07-01Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

No practical mitigation beyond upgrading. The PulseAudio protocol server is a core module required for PulseAudio application compatibility.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 10
Red Hat
pipewire
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.4.11-1.el10_2.2; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
pipewire
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.4.11-1.el9_8.2; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 10
Red Hat
libkrun
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
pipewire
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
pipewire0.2
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 5.5
medium		 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References