CVE catalog

CVE-2026-14330

Multiple unbounded alloca() calls in the PulseAudio protocol server.

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Jul 1, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.16% · Oct 25, 2026

Multiple unbounded alloca() calls in the PulseAudio protocol server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pipewire	sid	`1.6.9-2`	fixed
Debian	pipewire	forky	`1.6.9-2`	fixed
Debian	pipewire	trixie	`1.4.2-1`	vulnerable
Debian	pipewire	bookworm	`0.3.65-3+deb12u1`	vulnerable
Cpe	pulseaudio	Not reported	Not reported	vulnerable
Cpe	pipewire	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	gstreamer1.0-pipewire	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libpipewire-0.3-0t64	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libpipewire-0.3-common	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libpipewire-0.3-dev	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libpipewire-0.3-modules	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libpipewire-0.3-modules-x11	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libspa-0.2-bluetooth	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libspa-0.2-dev	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libspa-0.2-jack	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libspa-0.2-libcamera	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	libspa-0.2-modules	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-alsa	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-audio	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-audio-client-libraries	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-bin	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-doc	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-jack	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-libcamera	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-pulse	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-tests	Not reported	`1.0.5-1ubuntu3.3`	fixed
Cpe	pipewire-v4l2	Not reported	`1.0.5-1ubuntu3.3`	fixed
Ubuntu	pipewire	22.04	`0.3.32-1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.39-4`	vulnerable
Ubuntu	pipewire	22.04	`0.3.40-1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.40-2`	vulnerable
Ubuntu	pipewire	22.04	`0.3.41-1ubuntu1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.42-1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.43-2`	vulnerable
Ubuntu	pipewire	22.04	`0.3.44-1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.45-1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.47-1ubuntu1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.48-1ubuntu1`	vulnerable
Ubuntu	pipewire	22.04	`0.3.48-1ubuntu2`	vulnerable
Ubuntu	pipewire	22.04	`0.3.48-1ubuntu3`	vulnerable
Ubuntu	pipewire	22.04	`0.3.48-1ubuntu3.2`	fixed
Ubuntu	pipewire	24.04	`0.3.79-2`	vulnerable
Ubuntu	pipewire	24.04	`0.3.83-1`	vulnerable
Ubuntu	pipewire	24.04	`0.3.84-1`	vulnerable
Ubuntu	pipewire	24.04	`0.3.85-1`	vulnerable
Ubuntu	pipewire	24.04	`1.0.0-1ubuntu1`	vulnerable
Ubuntu	pipewire	24.04	`1.0.1-1ubuntu2`	vulnerable
Ubuntu	pipewire	24.04	`1.0.1-1ubuntu3`	vulnerable
Ubuntu	pipewire	24.04	`1.0.2-1ubuntu1`	vulnerable
Ubuntu	pipewire	24.04	`1.0.3-1ubuntu2`	vulnerable
Ubuntu	pipewire	24.04	`1.0.4-2ubuntu2`	vulnerable
Ubuntu	pipewire	24.04	`1.0.4-2ubuntu3`	vulnerable
Ubuntu	pipewire	24.04	`1.0.4-2ubuntu4`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1ubuntu1`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1ubuntu2`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1ubuntu3`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1ubuntu3.1`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1ubuntu3.2`	vulnerable
Ubuntu	pipewire	24.04	`1.0.5-1ubuntu3.3`	fixed
Ubuntu	pipewire	25.10	`1.2.7-1ubuntu5`	vulnerable
Ubuntu	pipewire	25.10	`1.2.7-1ubuntu6`	vulnerable
Ubuntu	pipewire	25.10	`1.4.2-1ubuntu3`	vulnerable
Ubuntu	pipewire	25.10	`1.4.2-1ubuntu4`	vulnerable
Ubuntu	pipewire	25.10	`1.4.5-1ubuntu1`	vulnerable
Ubuntu	pipewire	25.10	`1.4.5-1ubuntu2`	vulnerable
Ubuntu	pipewire	25.10	`1.4.7-3ubuntu1`	vulnerable
Ubuntu	pipewire	25.10	`1.4.7-3ubuntu2`	vulnerable
Ubuntu	pipewire	26.04	`1.4.7-3ubuntu2`	vulnerable
Ubuntu	pipewire	26.04	`1.4.9-1ubuntu1`	vulnerable
Ubuntu	pipewire	26.04	`1.5.84-1ubuntu2`	vulnerable
Ubuntu	pipewire	26.04	`1.6.0-1ubuntu2`	vulnerable
Ubuntu	pipewire	26.04	`1.6.2-1ubuntu1`	vulnerable
Ubuntu	pipewire	26.04	`1.6.2-1ubuntu1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pipewire	source	sid	`1.6.9-2`	not yet assigned	Not reported	[1141309]
Debian	pipewire	source	forky	`1.6.9-2`	not yet assigned	Not reported	[1141309]
Debian	pipewire	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1141309]
Debian	pipewire	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1141309]
Cpe	pipewire	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	gstreamer1.0-pipewire	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libpipewire-0.3-0t64	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libpipewire-0.3-common	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libpipewire-0.3-dev	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libpipewire-0.3-modules	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libpipewire-0.3-modules-x11	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libspa-0.2-bluetooth	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libspa-0.2-dev	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libspa-0.2-jack	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libspa-0.2-libcamera	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	libspa-0.2-modules	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-alsa	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-audio	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-audio-client-libraries	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-bin	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-doc	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-jack	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-libcamera	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-pulse	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-tests	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Cpe	pipewire-v4l2	cpe	Not reported	`1.0.5-1ubuntu3.3`	Not reported	Not reported	Not reported
Ubuntu	pipewire	deb	22.04	`0.3.48-1ubuntu3.2`	Not reported	UBUNTU-CVE-2026-14330	Not reported
Ubuntu	pipewire	deb	24.04	`1.0.5-1ubuntu3.3`	Not reported	UBUNTU-CVE-2026-14330	Not reported
Ubuntu	pipewire	deb	26.04	`1.6.2-1ubuntu1.1`	Not reported	UBUNTU-CVE-2026-14330	Not reported

[Debian bug #1141309]

Notes

[trixie] pipewire: Minor issue [bookworm] pipewire: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gstreamer1.0-pipewire]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libpipewire-0.3-0]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libpipewire-0.3-common]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · all · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · all · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libpipewire-0.3-dev]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libpipewire-0.3-modules]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libpipewire-0.3-modules-x11]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libpulse0]Affected
Source package: [pulseaudio]
Details (2)
- 16.1+dfsg1-2+b1 · amd64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
- 16.1+dfsg1-2+b1 · arm64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
[libpulse-dev]Affected
Source package: [pulseaudio]
Details (2)
- 16.1+dfsg1-2+b1 · amd64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
- 16.1+dfsg1-2+b1 · arm64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
[libpulsedsp]Affected
Source package: [pulseaudio]
Details (2)
- 16.1+dfsg1-2+b1 · amd64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
- 16.1+dfsg1-2+b1 · arm64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
[libpulse-mainloop-glib0]Affected
Source package: [pulseaudio]
Details (2)
- 16.1+dfsg1-2+b1 · amd64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
- 16.1+dfsg1-2+b1 · arm64 · bookworm
  Affected
  nvd · pulseaudio · debian · bookworm
[libspa-0.2-bluetooth]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libspa-0.2-dev]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libspa-0.2-jack]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libspa-0.2-libcamera]Affected
Source package: [pipewire]
Details (2)
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[libspa-0.2-modules]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[pipewire]Affected
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[pipewire-alsa]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[pipewire-audio]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · all · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · all · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[pipewire-audio-client-libraries]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · all · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · all · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
[pipewire-bin]Affected
Source package: [pipewire]
Details (4)
- 0.3.65-3+deb12u1 · amd64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 0.3.65-3+deb12u1 · arm64 · bookworm
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12
- 1.4.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · pipewire · debian · bookworm; nvd · pipewire · debian · 12

Next results

Observed: Oct 23, 2026, 9:44:36 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]