Executive brief
A vulnerability in the PipeWire audio service, which manages sound and video streams on Linux systems, could allow a local user to crash the system's audio server. By sending specially crafted requests that exceed memory limits, an attacker can cause the service to stop responding, leading to a loss of audio functionality for all users on the machine. This primarily impacts system stability and availability rather than data confidentiality.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in PipeWire's PulseAudio protocol server implementation. Multiple functions utilize the alloca() system call to allocate memory on the stack based on counts provided by card parameters or client properties without performing adequate bounds checking. A local, authenticated attacker acting as a malicious PulseAudio client can provide excessively large parameter counts to trigger a stack overflow. This results in stack exhaustion and the subsequent crash of the PipeWire daemon, leading to a denial-of-service (DoS) condition for audio services.
Affected products
- Red Hat Red Hat Enterprise Linux 8 pipewire, pipewire0.2
- Red Hat Red Hat Enterprise Linux 9 pipewire
- Red Hat Red Hat Enterprise Linux 10 pipewire, libkrun
Timeline
- 2026-07-01: disclosed: Initial report via Red Hat Bugzilla and NVD publication.