OESA-2026-4632

    Dashboard / Vulnerabilities / OESA-2026-4632

    OESA-2026-4632

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary: pipewire security update

    Details: is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fix(es): Multiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330) A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.(CVE-2026-5674)

    References: https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4632, https://nvd.nist.gov/vuln/detail/CVE-2026-14330, https://nvd.nist.gov/vuln/detail/CVE-2026-5674

    Affected packages

    Package

    Name: pipewire

    Purl: pkg:rpm/openEuler/pipewire&distro=openEuler-24.03-LTS-SP3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.3.63-7.oe2403sp3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2026-4632 | CVE-DB