Multiple unbounded alloca() calls in the PulseAudio protocol server.

Project Subscriptions

Vendors Products
Pipewire Subscribe
Pipewire Subscribe
Enterprise Linux Subscribe
Enterprise Linux Eus Subscribe
Rhel E4s Subscribe
Rhel Eus Subscribe
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8535-1 PipeWire vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No practical mitigation beyond upgrading. The PulseAudio protocol server is a core module required for PulseAudio application compatibility.

History

Thu, 05 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:10
cpe:/a:redhat:enterprise_linux:8

Wed, 04 Nov 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References

Tue, 03 Nov 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_e4s:9.4::appstream
Vendors & Products Redhat rhel E4s
References

Tue, 03 Nov 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
Vendors & Products Redhat rhel Eus
References

Mon, 02 Nov 2026 05:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10.2
References

Mon, 31 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
References

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Pipewire
Pipewire pipewire
Vendors & Products Pipewire
Pipewire pipewire

Thu, 02 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Moderate


Wed, 01 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Description Multiple unbounded alloca() calls in the PulseAudio protocol server.
Title Pipewire: pulse server alloca stack overflow
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-770
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-05T16:41:01.509Z

Reserved: 2026-07-01T12:29:58.653Z

Link: CVE-2026-14330

cve-icon Vulnrichment

Updated: 2026-07-01T15:37:24.485Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-01T15:17:06.663

Modified: 2026-11-05T17:18:07.450

Link: CVE-2026-14330

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-01T00:00:00Z

Links: CVE-2026-14330 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:30:04Z

Weaknesses