{"id":"CVE-2026-14330","aliases":["ALSA-2026:61240","ALSA-2026:93442","AZL-92012","CLSA-2026-1788871614","DEBIAN-CVE-2026-14330","EUVD-2026-41007","GHSA-26rf-3h26-fc3w","MGASA-2026-0443","OESA-2026-4632","OESA-2026-4633","OESA-2026-4634","RHSA-2026:61240","RLSA-2026:61240","RLSA-2026:93442","UBUNTU-CVE-2026-14330","USN-8535-1"],"status":"published","title":"Pipewire: pulse server alloca stack overflow","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00156,"percentile":0.04833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-07-01T14:09:25Z","modified":"2026-11-05T17:18:07Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"pipewire","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-alsa","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-devel","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-gstreamer","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-jack-audio-connection-kit","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-jack-audio-connection-kit-devel","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-jack-audio-connection-kit-libs","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-libs","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-module-x11","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-plugin-libcamera","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-pulseaudio","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"pipewire-utils","fixed_in":["1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pipewire","fixed_in":["1.6.9-2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"pipewire","fixed_in":["0:1.4.11-1.el10_2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pipewire","fixed_in":["0.3.48-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pipewire","fixed_in":["1.0.5-1ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pipewire","fixed_in":["1.6.2-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-jack-audio-connection-kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-jack-audio-connection-kit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-jack-audio-connection-kit-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-module-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pipewire-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-jack-audio-connection-kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-jack-audio-connection-kit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-jack-audio-connection-kit-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-module-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-plugin-libcamera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"pipewire-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.60-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-jack-audio-connection-kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-jack-audio-connection-kit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-jack-audio-connection-kit-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-module-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-plugin-vulkan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"pipewire-v4l2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.65-3","0.3.65-3+deb12u1","0.3.66-1","0.3.67-1","0.3.67-2","0.3.68-1","0.3.69-1","0.3.70-1","0.3.70-2","0.3.71-1","0.3.71-2","0.3.72-1","0.3.72-2","0.3.73-1","0.3.74-1","0.3.74-1~bpo11+1","0.3.74-1~bpo12+1","0.3.76-1","0.3.76-1~bpo11+1","0.3.76-1~bpo12+1","0.3.77-1","0.3.77-1~bpo11+1","0.3.77-1~bpo12+1","0.3.78-1","0.3.79-1","0.3.79-1~bpo11+1","0.3.79-1~bpo12+1","0.3.79-2","0.3.80-1","0.3.80-2","0.3.80-2~bpo11+1","0.3.80-2~bpo12+1","0.3.81-1","0.3.82-1","0.3.82-1~bpo11+1","0.3.82-1~bpo12+1","0.3.83-1","0.3.83-1~bpo11+1","0.3.83-1~bpo12+1","0.3.84-1","0.3.84-1~bpo12+1","0.3.85-1","0.3.85-1~bpo11+1","0.3.85-1~bpo12+1","1.0.0-1","1.0.0-1~bpo11+1","1.0.0-1~bpo12+1","1.0.0-2","1.0.0-3","1.0.1-1","1.0.1-1~bpo11+1","1.0.1-1~bpo12+1","1.0.1-2","1.0.2-1","1.0.3-1","1.0.3-1.1","1.0.3-1.1~exp1","1.0.3-1~bpo11+1","1.0.3-1~bpo12+1","1.0.4-1","1.0.4-2","1.0.4-3","1.0.5-1","1.0.5-1~bpo12+1","1.0.6-1","1.0.7-1","1.0.7-1~bpo12+1","1.1.81-1","1.1.82-1","1.1.83-1","1.2.0-1","1.2.0-1~bpo12+1","1.2.1-1","1.2.1-1~bpo12+1","1.2.2-1","1.2.3-1","1.2.3-1~bpo12+1","1.2.4-1","1.2.4-1~bpo12+1","1.2.4-2","1.2.5-1","1.2.5-1~bpo12+1","1.2.6-1","1.2.7-1","1.2.7-1~bpo12+1","1.3.81-1","1.3.82-1","1.3.83-1","1.4.0-1","1.4.1-1","1.4.10-1","1.4.2-1","1.4.2-1~bpo12+1","1.4.3-1","1.4.4-1","1.4.5-1","1.4.6-1","1.4.7-1","1.4.7-2","1.4.7-3","1.4.7-3~bpo13+1","1.4.8-1","1.4.9-1","1.4.9-1~bpo13+1","1.4.9-1~bpo13+2","1.5.81-1","1.5.83-1","1.5.84-1","1.5.85-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.4-1","1.6.5-1","1.6.6-1","1.6.7-1","1.6.8-1","1.6.9-1","1.6.9-2","1.6.9-2~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.10-1","1.4.2-1","1.4.3-1","1.4.4-1","1.4.5-1","1.4.6-1","1.4.7-1","1.4.7-2","1.4.7-3","1.4.7-3~bpo13+1","1.4.8-1","1.4.9-1","1.4.9-1~bpo13+1","1.4.9-1~bpo13+2","1.5.81-1","1.5.83-1","1.5.84-1","1.5.85-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.4-1","1.6.5-1","1.6.6-1","1.6.7-1","1.6.8-1","1.6.9-1","1.6.9-2","1.6.9-2~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2"}]}],"versions":["1.4.10-1","1.4.2-1","1.4.3-1","1.4.4-1","1.4.5-1","1.4.6-1","1.4.7-1","1.4.7-2","1.4.7-3","1.4.7-3~bpo13+1","1.4.8-1","1.4.9-1","1.4.9-1~bpo13+1","1.4.9-1~bpo13+2","1.5.81-1","1.5.83-1","1.5.84-1","1.5.85-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.4-1","1.6.5-1","1.6.6-1","1.6.7-1","1.6.8-1","1.6.9-1","1.6.9-2~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.85-6.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.63-7.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.63-7.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.63-7.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-alsa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-gstreamer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-jack-audio-connection-kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-jack-audio-connection-kit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-jack-audio-connection-kit-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-jack-audio-connection-kit-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-module-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-module-x11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-plugin-vulkan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-pulseaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-pulseaudio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pipewire-v4l2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.11-1.el10_2.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.48-1ubuntu3.2"}]}],"versions":["0.3.32-1","0.3.39-4","0.3.40-1","0.3.40-2","0.3.41-1ubuntu1","0.3.42-1","0.3.43-2","0.3.44-1","0.3.45-1","0.3.47-1ubuntu1","0.3.48-1ubuntu1","0.3.48-1ubuntu2","0.3.48-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-1ubuntu3.3"}]}],"versions":["0.3.79-2","0.3.83-1","0.3.84-1","0.3.85-1","1.0.0-1ubuntu1","1.0.1-1ubuntu2","1.0.1-1ubuntu3","1.0.2-1ubuntu1","1.0.3-1ubuntu2","1.0.4-2ubuntu2","1.0.4-2ubuntu3","1.0.4-2ubuntu4","1.0.5-1","1.0.5-1ubuntu1","1.0.5-1ubuntu2","1.0.5-1ubuntu3","1.0.5-1ubuntu3.1","1.0.5-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.7-1ubuntu5","1.2.7-1ubuntu6","1.4.2-1ubuntu3","1.4.2-1ubuntu4","1.4.5-1ubuntu1","1.4.5-1ubuntu2","1.4.7-3ubuntu1","1.4.7-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1ubuntu1.1"}]}],"versions":["1.4.7-3ubuntu2","1.4.9-1ubuntu1","1.5.84-1ubuntu2","1.6.0-1ubuntu2","1.6.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.48-1ubuntu3.2"}]}],"versions":["0.3.32-1","0.3.39-4","0.3.40-1","0.3.40-2","0.3.41-1ubuntu1","0.3.42-1","0.3.43-2","0.3.44-1","0.3.45-1","0.3.47-1ubuntu1","0.3.48-1ubuntu1","0.3.48-1ubuntu2","0.3.48-1ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-1ubuntu3.3"}]}],"versions":["0.3.79-2","0.3.83-1","0.3.84-1","0.3.85-1","1.0.0-1ubuntu1","1.0.1-1ubuntu2","1.0.1-1ubuntu3","1.0.2-1ubuntu1","1.0.3-1ubuntu2","1.0.4-2ubuntu2","1.0.4-2ubuntu3","1.0.4-2ubuntu4","1.0.5-1","1.0.5-1ubuntu1","1.0.5-1ubuntu2","1.0.5-1ubuntu3","1.0.5-1ubuntu3.1","1.0.5-1ubuntu3.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1ubuntu1.1"}]}],"versions":["1.4.7-3ubuntu2","1.4.9-1ubuntu1","1.5.84-1ubuntu2","1.6.0-1ubuntu2","1.6.2-1ubuntu1"],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:61240","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93442","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94436","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94437","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94490","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94997","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14330","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495907","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14330","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-26rf-3h26-fc3w"},{"url":"https://access.redhat.com/security/cve/CVE-2026-14324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2495903","tags":["report"]},{"url":"https://bugzilla.redhat.com/2495907","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61240.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-93442.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788871614.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14324","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14330","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0443.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35929","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8535-1","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495903","tags":["report"]},{"url":"https://gitlab.freedesktop.org/pipewire/pipewire/-/work_items/5352","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5674","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4633","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4634","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61240.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14324","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14330","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61240","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93442","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14324","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-14330","title":"Pipewire: pulse server alloca stack overflow","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T14:09:25.189Z","modified":"2026-11-05T16:41:01.509Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-05T17:53:58.925122Z"}],"euvd":[{"id":"EUVD-2026-41007","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T14:09:25Z","modified":"2026-11-05T16:41:01Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T18:00:57.863749Z"}],"ghsa":[{"id":"GHSA-26rf-3h26-fc3w","title":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T15:35:19Z","modified":"2026-11-04T15:32:02Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-04T15:52:08.140959Z"}],"nvd":[{"id":"CVE-2026-14330","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T15:17:06.663Z","modified":"2026-11-05T17:18:07.45Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"DEBIAN-CVE-2026-14330","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T15:17:06.663Z","modified":"2026-11-05T09:47:33.798723607Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-4632","title":"pipewire security update","description":"is a server and user space API to deal with multimedia pipelines,contains command line utilities.\r\n\r\nSecurity Fix(es):\n\nMultiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330)\n\nA flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire\u0026apos;s PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user\u0026apos;s system.(CVE-2026-5674)","status":"published","published":"2026-10-29T09:03:49Z","modified":"2026-10-29T09:15:42.754445533Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4633","title":"pipewire security update","description":"is a server and user space API to deal with multimedia pipelines,contains command line utilities.\r\n\r\nSecurity Fix(es):\n\nMultiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330)\n\nA flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire\u0026apos;s PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user\u0026apos;s system.(CVE-2026-5674)","status":"published","published":"2026-10-29T09:03:49Z","modified":"2026-10-29T09:15:43.312750654Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4634","title":"pipewire security update","description":"is a server and user space API to deal with multimedia pipelines,contains command line utilities.\r\n\r\nSecurity Fix(es):\n\nMultiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330)\n\nA flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire\u0026apos;s PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user\u0026apos;s system.(CVE-2026-5674)","status":"published","published":"2026-10-29T09:03:50Z","modified":"2026-10-29T09:15:41.110110884Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:61240","title":"Red Hat Security Advisory: pipewire security update","status":"published","published":"2026-08-31T10:12:03Z","modified":"2026-08-31T10:16:38.735301083Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:61240","title":"Moderate: pipewire security update","description":"PipeWire is a multimedia server for Linux and other Unix like operating systems.\n\nSecurity Fix(es):\n\n* pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)\n\n* pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-31T12:05:35.058762Z","modified":"2026-08-31T12:30:02.764276833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:93442","title":"Moderate: pipewire security update","description":"PipeWire is a multimedia server for Linux and other Unix like operating systems.\n\nSecurity Fix(es):\n\n* pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:10:03.560067Z","modified":"2026-11-03T12:30:03.482966839Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"UBUNTU-CVE-2026-14330","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T15:17:00Z","modified":"2026-07-14T01:55:43.072300673Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:61240","title":"Moderate: pipewire security update","description":"PipeWire is a multimedia server for Linux and other Unix like operating systems.  \n\nSecurity Fix(es):  \n\n  * pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)\n  * pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:08.042585119Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:93442","title":"Moderate: pipewire security update","description":"PipeWire is a multimedia server for Linux and other Unix like operating systems.  \n\nSecurity Fix(es):  \n\n  * pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-02T23:15:02.358755588Z","updated_at":"2026-11-03T00:02:57.75152Z"},{"id":"AZL-92012","title":"CVE-2026-14330 affecting package pipewire 0.3.60-3","description":"Multiple unbounded alloca() calls in the PulseAudio protocol server.","status":"published","published":"2026-07-01T15:17:06Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1788871614","title":"pipewire: Fix of 2 CVEs","description":"- CVE-2026-14324: RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return\n- CVE-2026-14330: Multiple unbounded alloca() calls in the PulseAudio protocol server","status":"published","published":"2026-09-08T12:47:06Z","modified":"2026-10-26T09:31:32.366546248Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0443","title":"Updated pipewire packages fix security vulnerabilities","description":"RAOP module accepts unbounded Content-Length values and does not check\nthe pw_array_add() return. (CVE-2026-14324)\nMultiple unbounded alloca() calls in the PulseAudio protocol server.\n(CVE-2026-14330)\n","status":"published","published":"2026-09-23T23:49:21Z","modified":"2026-09-24T00:00:03.35196626Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8535-1","title":"pipewire vulnerabilities","description":"It was discovered that PipeWire accepted unbounded Content-Length values\nin its RAOP module. A remote attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2026-14324)\n\nIt was discovered that PipeWire performed multiple unbounded stack\nallocations in its PulseAudio protocol server. A local attacker could\npossibly use this issue to cause a denial of service. (CVE-2026-14330)","status":"published","published":"2026-07-13T15:54:16Z","modified":"2026-07-14T02:11:32.603352257Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}