CVE-2026-14330
Description
Multiple unbounded alloca() calls in the PulseAudio protocol server.
Statement
This vulnerability is rated as having Moderate impact because exploitation is restricted to authenticated local users who can interact with the user session's audio daemon, limiting the scope strictly to a denial of service. While PipeWire provides audio services in standard desktop environments across Red Hat Enterprise Linux, triggering this stack exhaustion issue only terminates the user's multimedia server process without compromising data confidentiality or system integrity. Furthermore, the failure does not permit privilege escalation beyond the local user account, and headless server deployments without graphical sessions remain unaffected.
Mitigation
No practical mitigation beyond upgrading. The PulseAudio protocol
server is a core module required for PulseAudio application
compatibility.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Acknowledgements
Red Hat would like to thank Tristan Madani for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
