CVE-2026-14330

is a server and user space API to deal with multimedia pipelines,contains command line utilities.

Security Fix(es):

Multiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330)

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.(CVE-2026-5674)

is a server and user space API to deal with multimedia pipelines,contains command line utilities.

Security Fix(es):

Multiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330)

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.(CVE-2026-5674)

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

• pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)

• pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

• pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple unbounded alloca() calls in the PulseAudio protocol server.

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

• pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)
• pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

• pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple unbounded alloca() calls in the PulseAudio protocol server.

• CVE-2026-14324: RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return
• CVE-2026-14330: Multiple unbounded alloca() calls in the PulseAudio protocol server

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. (CVE-2026-14324) Multiple unbounded alloca() calls in the PulseAudio protocol server. (CVE-2026-14330)

It was discovered that PipeWire accepted unbounded Content-Length values in its RAOP module. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-14324)

It was discovered that PipeWire performed multiple unbounded stack allocations in its PulseAudio protocol server. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-14330)