CVE-2026-14330
Pipewire: pulse server alloca stack overflow
CVSS 3.1 5.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-14330
PublishedMultiple unbounded alloca() calls in the PulseAudio protocol server.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-14330 · CVE overview and exploitation status
cve-program · CVE-2026-14330
- https://access.redhat.com/errata/RHSA-2026:61240
- https://access.redhat.com/errata/RHSA-2026:93442
- https://access.redhat.com/errata/RHSA-2026:94436
- https://access.redhat.com/errata/RHSA-2026:94437
- https://access.redhat.com/errata/RHSA-2026:94490
- https://access.redhat.com/errata/RHSA-2026:94997
- https://access.redhat.com/security/cve/CVE-2026-14330
- https://bugzilla.redhat.com/show_bug.cgi?id=2495907
Related changes
Linked by CVE identifier- Pipewire: pulse server alloca stack overflow · Affected-version evidence changed · 5 Nov 2026
- Pipewire: pulse server alloca stack overflow · Affected-version evidence changed · 4 Nov 2026
- Pipewire: pulse server alloca stack overflow · Affected-version evidence changed · 3 Nov 2026
- Pipewire: pulse server alloca stack overflow · Affected-version evidence changed · 3 Nov 2026
- Pipewire: pulse server alloca stack overflow · Affected-version evidence changed · 2 Nov 2026
- Pipewire: pulse server alloca stack overflow · Affected-version evidence changed · 30 Oct 2026