CVE-2026-14330

EUVD-2026-41007
Multiple unbounded alloca() calls in the PulseAudio protocol server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 0.99%
Debian logo
Debian Releases
Debian Product
Codename
pulseaudio
bookworm
postponed
bullseye
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pipewire
focal
not-affected
jammy
Fixed 0.3.48-1ubuntu3.2
released
noble
Fixed 1.0.5-1ubuntu3.3
released
questing
ignored
resolute
Fixed 1.6.2-1ubuntu1.1
released
pulseaudio
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
xenial
not-affected
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
pipewire
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-alsa
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-alsa-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-config-rates
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-config-upmix
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-debugsource
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-devel
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-doc
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-gstreamer
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-gstreamer-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-devel
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-libs
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-libs-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-libs
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-libs-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-module-x11
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-module-x11-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-plugin-vulkan
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-plugin-vulkan-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-pulseaudio
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-pulseaudio-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-utils
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-utils-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-v4l2
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-v4l2-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-14330
https://bugzilla.redhat.com/show_bug.cgi?id=2495907