Is CVE-2026-14330 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14330 being exploited in the wild.

How severe is CVE-2026-14330?

Medium severity, with a CVSS score of 5.5, published 1 July 2026.

Which products and versions are affected?

Red Hat Red Hat Enterprise Linux 8 pipewire, pipewire0.2; Red Hat Red Hat Enterprise Linux 9 pipewire; Red Hat Red Hat Enterprise Linux 10 pipewire, libkrun.

Is there a fix for CVE-2026-14330?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14330 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-14330?

Check whether you run Red Hat Libkrun or Red Hat PipeWire. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14330: Red Hat PipeWire denial of service via unbounded alloca in Pulse Server

CVE-2026-14330 · Severity: medium · CVSS 5.5 · Published 2026-07-01

A vulnerability in the PipeWire audio service, which manages sound and video streams on Linux systems, could allow a local user to crash the system's audio server. By sending specially crafted requests that exceed memory limits, an attacker can cause the service to stop responding, leading to a loss of audio functionality for all users on the machine. This primarily impacts system stability and availability rather than data confidentiality.

Technologies: Red Hat PipeWire. Vendors: Red Hat.

Quick answers

Is CVE-2026-14330 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14330 being exploited in the wild.
How severe is CVE-2026-14330?: Medium severity, with a CVSS score of 5.5, published 1 July 2026.
Which products and versions are affected?: Red Hat Red Hat Enterprise Linux 8 pipewire, pipewire0.2; Red Hat Red Hat Enterprise Linux 9 pipewire; Red Hat Red Hat Enterprise Linux 10 pipewire, libkrun.
Is there a fix for CVE-2026-14330?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14330 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-14330?: Check whether you run Red Hat Libkrun or Red Hat PipeWire. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in PipeWire's PulseAudio protocol server implementation. Multiple functions utilize the alloca() system call to allocate memory on the stack based on counts provided by card parameters or client properties without performing adequate bounds checking. A local, authenticated attacker acting as a malicious PulseAudio client can provide excessively large parameter counts to trigger a stack overflow. This results in stack exhaustion and the subsequent crash of the PipeWire daemon, leading to a denial-of-service (DoS) condition for audio services.

Affected products

Red Hat Red Hat Enterprise Linux 8 pipewire, pipewire0.2
Red Hat Red Hat Enterprise Linux 9 pipewire
Red Hat Red Hat Enterprise Linux 10 pipewire, libkrun

Timeline

2026-07-01: disclosed: Initial report via Red Hat Bugzilla and NVD publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.