CVE-2026-14330

Multiple unbounded alloca() calls in the PulseAudio protocol server.

This vulnerability is rated as having Moderate impact because exploitation is restricted to authenticated local users who can interact with the user session's audio daemon, limiting the scope strictly to a denial of service. While PipeWire provides audio services in standard desktop environments across Red Hat Enterprise Linux, triggering this stack exhaustion issue only terminates the user's multimedia server process without compromising data confidentiality or system integrity. Furthermore, the failure does not permit privilege escalation beyond the local user account, and headless server deployments without graphical sessions remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No practical mitigation beyond upgrading. The PulseAudio protocol server is a core module required for PulseAudio application compatibility.