RLSA-2026:93442: Moderate: pipewire security update

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

Q: What is the expected security impact?

The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact.

Q: Can the affected PipeWire versions be identified from this advisory?

No affected or fixed version numbers are provided in the available advisory data.

Published Nov 3, 2026

Updated

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/pipewire<0:1.4.11-1.el10_2.2

0:1.4.11-1.el10_2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/pipewire to a version that resolves this vulnerability.
Fixed in 0:1.4.11-1.el10_2.2

Event History

Nov 3, 2026

Advisory Published

via OSV·12:10 PM

Data Sourced

via OSV·12:10 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-14330

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?