rpm package
almalinux/pipewire-pulseaudio
pkg:rpm/almalinux/pipewire-pulseaudio
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-5674 | Hig | 8.8 | < 1.4.11-1.el9_8 | 1.4.11-1.el9_8 | Jul 16, 2026 | A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a mali | |
| CVE-2026-14330 | Med | 5.5 | < 1.4.11-1.el9_8.2 | 1.4.11-1.el9_8.2 | Jul 1, 2026 | Multiple unbounded alloca() calls in the PulseAudio protocol server. | |
| CVE-2026-14324 | Med | 6.5 | < 1.4.11-1.el9_8.2 | 1.4.11-1.el9_8.2 | Jul 1, 2026 | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. |
- affected < 1.4.11-1.el9_8fixed 1.4.11-1.el9_8
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a mali
- affected < 1.4.11-1.el9_8.2fixed 1.4.11-1.el9_8.2
Multiple unbounded alloca() calls in the PulseAudio protocol server.
- affected < 1.4.11-1.el9_8.2fixed 1.4.11-1.el9_8.2
RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.