CVE-2026-14330

EUVD-2026-41007
Multiple unbounded alloca() calls in the PulseAudio protocol server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.27%
Debian logo
Debian Releases
Debian Product
Codename
pipewire
bookworm
postponed
bullseye
postponed
forky
1.6.9-2
fixed
sid
1.6.9-2
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pipewire
focal
not-affected
jammy
Fixed 0.3.48-1ubuntu3.2
released
noble
Fixed 1.0.5-1ubuntu3.3
released
questing
ignored
resolute
Fixed 1.6.2-1ubuntu1.1
released
pulseaudio
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
xenial
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
pipewire
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-alsa
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-devel
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-gstreamer
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-jack-audio-connection-kit
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-jack-audio-connection-kit-devel
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-jack-audio-connection-kit-libs
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-libs
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-module-x11
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-pulseaudio
RHEL 9
0:1.4.11-1.el9_8.2
fixed
pipewire-utils
RHEL 9
0:1.4.11-1.el9_8.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
pipewire
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-alsa
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-alsa-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-config-rates
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-config-upmix
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-debugsource
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-devel
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-doc
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-gstreamer
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-gstreamer-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-devel
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-libs
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-libs-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-libs
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-libs-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-module-x11
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-module-x11-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-plugin-vulkan
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-plugin-vulkan-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-pulseaudio
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-pulseaudio-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-utils
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-utils-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-v4l2
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-v4l2-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:61240
https://access.redhat.com/security/cve/CVE-2026-14330
https://bugzilla.redhat.com/show_bug.cgi?id=2495907