A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

A flaw was found in PipeWire's PulseAudio protocol server. Multiple functions use alloca() without bounds checking to allocate arrays based on counts from card parameters or client properties. A malicious PulseAudio client can trigger stack exhaustion by sending requests with very large parameter counts, crashing the PipeWire daemon.