CVE-2026-14330

MediumCVSS 5.5

Published: 01/07/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile — higher than 1% of all known CVEs

Multiple unbounded alloca() calls in the PulseAudio protocol server can lead to stack overflow and potential arbitrary code execution.

An attacker could remotely crash the service or take control of the system, compromising data confidentiality and integrity.

Immediately update PulseAudio to the latest patched version and restrict protocol server access to trusted hosts only.

Original NVD description (English source)

Multiple unbounded alloca() calls in the PulseAudio protocol server.