UBUNTU-CVE-2026-14330

🗓️ 01 Jul 2026 15:17:00Reported by GoogleType

osv

osv🔗 osv.dev👁 6 Views

Ubuntu CVE-2026-14330: PulseAudio protocol server has multiple unbounded alloca calls.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2026-14330	1 Jul 202614:09	–	attackerkb
Circl	CVE-2026-14330	2 Jul 202600:30	–	circl
CVE	CVE-2026-14330	1 Jul 202614:09	–	cve
Cvelist	CVE-2026-14330 Pipewire: pulse server alloca stack overflow	1 Jul 202614:09	–	cvelist
Debian CVE	CVE-2026-14330	1 Jul 202614:09	–	debiancve
EUVD	EUVD-2026-41007	1 Jul 202614:09	–	euvd
NVD	CVE-2026-14330	1 Jul 202615:17	–	nvd
OSV	DEBIAN-CVE-2026-14330	1 Jul 202615:17	–	osv
OSV	ECHO-47F1-73FB-7E9F Multiple unbounded alloca() calls in the PulseAudio protocol server, which an attacker can drive into a stack overflow by sending oversized protocol messages. The vulnerable code is the server side of the protocol. It builds into the PulseAudio daemon, shipped in the `pulseaudio` binary package, described by Debian as the "PulseAudio sound server". Echo containers do not install that package. What they pull in, as a transitive dependency of Chromium's audio support, is `libpulse0` — the "PulseAudio client libraries" — which ships only libpulse, libpulse-simple and libpulsecommon. There is no protocol server in those objects and no daemon on the image to reach. `libpulse0` is flagged only because it is built from the same `pulseaudio` source package that the advisory names, so a source-level match tags every binary package built from it, including ones that carry none of the affected code. Upstream attributes the flaw to PipeWire rather than PulseAudio. Red Hat files it as "pipewire: Pulse Server alloca Stack Overflow", NVD lists pipewire and libkrun as the affected packages, and Ubuntu's fix patches only PipeWire sources — module-protocol-pulse/pulse-server.c, message.c and defs.h. Debian tracks CVE-2026-14324, the sibling issue from that same advisory, against the pipewire source package, but filed this one under pulseaudio. No Echo image installs pipewire in any form. Verified on the built image: libpulse0 is the only pulse-related package present, with no daemon binary, no pipewire and no wireplumber. Its three objects — libpulse, libpulse-simple and libpulsecommon — export no protocol-server symbols and reference none of the affected sources; the source files they were built from are client and common code only, with no protocol-native.c. Debian rates the issue minor and marks it <no-dsa> for trixie. It is unfixed in every suite — trixie has 17.0+dfsg1-2 and forky/sid have 17.0+dfsg1-2.1, both vulnerable — so there is no version to move to even if it did apply. This statement is about which binary package carries the code, so it holds for as long as the image installs the client libraries without the daemon. MUST be re-evaluated if the `pulseaudio` package is ever added. https://security-tracker.debian.org/tracker/CVE-2026-14330	2 Jul 202621:26	–	osv
OSV	USN-8535-1 pipewire vulnerabilities	13 Jul 202615:54	–	osv

Source	Link
ubuntu	www.ubuntu.com/security/CVE-2026-14330
cve	www.cve.org/CVERecord
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/CVE-2026-14330
ubuntu	www.ubuntu.com/security/notices/USN-8535-1

14 Jul 2026 01:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.5

EPSS0.001

Ubuntu PulseAudio protocol server alloca calls