CVE-2026-14330: Pipewire: pulse server alloca stack overflow
A flaw was found in PipeWire's PulseAudio protocol server. Multiple functions use alloca() without bounds checking to allocate arrays based on counts from card parameters or client properties. A malicious PulseAudio client can trigger stack exhaustion by sending requests with very large parameter counts, crashing the PipeWire daemon.
Other sources
Multiple unbounded alloca() calls in the PulseAudio protocol server.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14330?
The severity of CVE-2026-14330 is rated as medium with a score of 5.5.
How do I fix CVE-2026-14330?
To address CVE-2026-14330, updating to the latest version of PipeWire that contains patches for this vulnerability is recommended.
What type of attack does CVE-2026-14330 enable?
CVE-2026-14330 allows a malicious PulseAudio client to trigger stack exhaustion through unvalidated parameter requests.
What software is affected by CVE-2026-14330?
CVE-2026-14330 affects the PipeWire software specifically within its PulseAudio protocol server.
What are the potential impacts of CVE-2026-14330?
The potential impacts of CVE-2026-14330 include service disruption and possible denial of service due to stack overflow.