CVE-2026-14330— Pipewire: pulse server alloca stack overflow
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any | unknown |
any | unknown | ||
| Red Hat | Red Hat Enterprise Linux 8 | any | unknown |
any | unknown | ||
| Red Hat | Red Hat Enterprise Linux 9 | any | unknown |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14330
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pipewire: pulse server alloca stack overflow
Source: NVD (National Vulnerability Database)
Vulnerability Description
Multiple unbounded alloca() calls in the PulseAudio protocol server.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Vulnerability Title
PipeWire 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PipeWire PipeWire是PipeWire组织的一款多媒体处理软件。 PipeWire存在资源管理错误漏洞，该漏洞源于多个无界alloca()调用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 9 | - | cpe:/o:redhat:enterprise_linux:9 |
II. Public POCs for CVE-2026-14330
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14330
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14330 (2)
- 🔗 2495907 – (CVE-2026-14330) CVE-2026-14330 pipewire: Pulse Server alloca Stack Overflowissue-trackingx_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-07-01 · 7 CVEs total
| CVE-2026-5136 | 8.8 HIGH | Foreman: foreman: privilege escalation to administrator-level access via usergroup role as |
| CVE-2026-14324 | 6.5 MEDIUM | Pipewire: raop rtsp null deref |
| CVE-2026-5135 | 6.5 MEDIUM | Foreman: foreman: unauthorized modification of host configurations via broken access contr |
| CVE-2026-5142 | 6.5 MEDIUM | Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass |
| CVE-2026-14258 | 6.5 MEDIUM | Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in rout |
| CVE-2026-5138 | 4.3 MEDIUM | Foreman: foreman: information disclosure via improper validation of nested request paramet |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
- CVE-2026-15028
Libarchive: heap overflow oob read while parsing a tar archi - CVE-2026-59692
Gstreamer: gstreamer: dtls certificate subject dn stack buff - CVE-2026-59691
Gstreamer: gstreamer: rfbsrc/librfb hextile heap out-of-boun - CVE-2026-14935
Gstreamer: gstreamer: webrtcbin accepts remote sdp without a - CVE-2026-14476
Sssd: sssd: gpo cache path traversal via unsanitized gpcfile
Same vendor: Red Hat
- CVE-2026-15028
Libarchive: heap overflow oob read while parsing a tar archi - CVE-2026-15378
Guardrails-detectors: guardrails-detectors: ssrf and local f - CVE-2026-59692
Gstreamer: gstreamer: dtls certificate subject dn stack buff - CVE-2026-59691
Gstreamer: gstreamer: rfbsrc/librfb hextile heap out-of-boun - CVE-2026-15154
Guardrails-detectors: guardrails-detectors: unauthenticated
Same weakness: CWE-770
- CVE-2026-58661
n8n - Disk Space Exhaustion via Data-Table File Upload Endpo - CVE-2026-56309
Capgo - Plan Bypass via Unrestricted Attachment Upload Endpo - CVE-2026-56814
Plug: multipart :length limit is not charged for part header - CVE-2026-60108
Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Ana - CVE-2026-12590
body-parser vulnerable to denial of service when invalid lim
V. Comments for CVE-2026-14330
No comments yet