{"id":"CVE-2022-4964","aliases":["DEBIAN-CVE-2022-4964","EUVD-2022-52216","GHSA-p626-3xpc-x4f6","UBUNTU-CVE-2022-4964"],"status":"published","title":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio...","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00282,"percentile":0.20832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2024-01-23T00:00:00Z","modified":"2026-10-15T08:03:12Z","fixes":[{"ecosystem":"Debian:13","package":"pipewire","fixed_in":["1.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pipewire","fixed_in":["1.0.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.65-3","0.3.65-3+deb12u1","0.3.66-1","0.3.67-1","0.3.67-2","0.3.68-1","0.3.69-1","0.3.70-1","0.3.70-2","0.3.71-1","0.3.71-2","0.3.72-1","0.3.72-2","0.3.73-1","0.3.74-1","0.3.74-1~bpo11+1","0.3.74-1~bpo12+1","0.3.76-1","0.3.76-1~bpo11+1","0.3.76-1~bpo12+1","0.3.77-1","0.3.77-1~bpo11+1","0.3.77-1~bpo12+1","0.3.78-1","0.3.79-1","0.3.79-1~bpo11+1","0.3.79-1~bpo12+1","0.3.79-2","0.3.80-1","0.3.80-2","0.3.80-2~bpo11+1","0.3.80-2~bpo12+1","0.3.81-1","0.3.82-1","0.3.82-1~bpo11+1","0.3.82-1~bpo12+1","0.3.83-1","0.3.83-1~bpo11+1","0.3.83-1~bpo12+1","0.3.84-1","0.3.84-1~bpo12+1","0.3.85-1","0.3.85-1~bpo11+1","0.3.85-1~bpo12+1","1.0.0-1","1.0.0-1~bpo11+1","1.0.0-1~bpo12+1","1.0.0-2","1.0.0-3","1.0.1-1","1.0.1-1~bpo11+1","1.0.1-1~bpo12+1","1.0.1-2","1.0.2-1","1.0.3-1","1.0.3-1.1","1.0.3-1.1~exp1","1.0.3-1~bpo11+1","1.0.3-1~bpo12+1","1.0.4-1","1.0.4-2","1.0.4-3","1.0.5-1","1.0.5-1~bpo12+1","1.0.6-1","1.0.7-1","1.0.7-1~bpo12+1","1.1.81-1","1.1.82-1","1.1.83-1","1.2.0-1","1.2.0-1~bpo12+1","1.2.1-1","1.2.1-1~bpo12+1","1.2.2-1","1.2.3-1","1.2.3-1~bpo12+1","1.2.4-1","1.2.4-1~bpo12+1","1.2.4-2","1.2.5-1","1.2.5-1~bpo12+1","1.2.6-1","1.2.7-1","1.2.7-1~bpo12+1","1.3.81-1","1.3.82-1","1.3.83-1","1.4.0-1","1.4.1-1","1.4.10-1","1.4.2-1","1.4.2-1~bpo12+1","1.4.3-1","1.4.4-1","1.4.5-1","1.4.6-1","1.4.7-1","1.4.7-2","1.4.7-3","1.4.7-3~bpo13+1","1.4.8-1","1.4.9-1","1.4.9-1~bpo13+1","1.4.9-1~bpo13+2","1.5.81-1","1.5.83-1","1.5.84-1","1.5.85-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.4-1","1.6.5-1","1.6.6-1","1.6.7-1","1.6.8-1","1.6.9-1","1.6.9-2","1.6.9-2~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.32-1","0.3.39-4","0.3.40-1","0.3.40-2","0.3.41-1ubuntu1","0.3.42-1","0.3.43-2","0.3.44-1","0.3.45-1","0.3.47-1ubuntu1","0.3.48-1ubuntu1","0.3.48-1ubuntu2","0.3.48-1ubuntu3","0.3.48-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wireplumber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.4-1","0.4.5-1","0.4.6-1","0.4.7-1","0.4.8-2","0.4.8-3","0.4.8-4"]}],"products":[{"vendor":"canonical","product":"ubuntu_pipewire-pulse"},{"vendor":"canonical ltd.","product":"ubuntu pipewire-pulse"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707/","tags":["issue-tracking","x_transferred","Exploit","Issue Tracking","evidence","report"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4964","tags":["issue-tracking","x_transferred","Third Party Advisory","advisory"]},{"url":"https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779","tags":["issue-tracking","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567","tags":["issue-tracking","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4964"},{"url":"https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707"},{"url":"https://github.com/advisories/GHSA-p626-3xpc-x4f6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-4964","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-4964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4964","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-4964","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-24T00:58:14.236Z","modified":"2025-06-20T19:20:11.172Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-52216","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-24T00:58:14Z","modified":"2025-06-20T19:20:11Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:18.601981Z"}],"ghsa":[{"id":"GHSA-p626-3xpc-x4f6","title":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio...","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-24T03:31:25Z","modified":"2025-06-20T21:31:52Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:02:46.844129Z"}],"nvd":[{"id":"CVE-2022-4964","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-24T01:15:07.977Z","modified":"2026-06-17T05:22:25.977Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:07:40.49892Z"}],"osv":[{"id":"CVE-2022-4964","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-24T01:15:07Z","modified":"2026-04-10T04:53:29.001469Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:28.416025Z"},{"id":"DEBIAN-CVE-2022-4964","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-24T01:15:07.977Z","modified":"2026-11-03T08:03:41.049844423Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:24.826312Z"},{"id":"UBUNTU-CVE-2022-4964","description":"Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.","status":"published","published":"2024-01-23T00:00:00Z","modified":"2026-07-13T20:30:11.25236455Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:03.879901Z"}]}}