🛡️ ECHO-47f1-73fb-7e9f — pulseaudio

Multiple unbounded alloca() calls in the PulseAudio protocol server, which

an attacker can drive into a stack overflow by sending oversized protocol

messages.

The vulnerable code is the server side of the protocol. It builds into the

PulseAudio daemon, shipped in the pulseaudio binary package, described by

Debian as the "PulseAudio sound server". Echo containers do not install

that package. What they pull in, as a transitive dependency of Chromium's

audio support, is libpulse0 — the "PulseAudio client libraries" — which

ships only libpulse, libpulse-simple and libpulsecommon. There is no

protocol server in those objects and no daemon on the image to reach.

libpulse0 is flagged only because it is built from the same pulseaudio

source package that the advisory names, so a source-level match tags every

binary package built from it, including ones that carry none of the

affected code.

Upstream attributes the flaw to PipeWire rather than PulseAudio. Red Hat

files it as "pipewire: Pulse Server alloca Stack Overflow", NVD lists

pipewire and libkrun as the affected packages, and Ubuntu's fix patches

only PipeWire sources — module-protocol-pulse/pulse-server.c, message.c

and defs.h. Debian tracks CVE-2026-14324, the sibling issue from that same

advisory, against the pipewire source package, but filed this one under

pulseaudio. No Echo image installs pipewire in any form.

Verified on the built image: libpulse0 is the only pulse-related package

present, with no daemon binary, no pipewire and no wireplumber. Its three

objects — libpulse, libpulse-simple and libpulsecommon — export no

protocol-server symbols and reference none of the affected sources; the

source files they were built from are client and common code only, with no

protocol-native.c.

Debian rates the issue minor and marks it <no-dsa> for trixie. It is

unfixed in every suite — trixie has 17.0+dfsg1-2 and forky/sid have

17.0+dfsg1-2.1, both vulnerable — so there is no version to move to even

if it did apply.

This statement is about which binary package carries the code, so it holds

for as long as the image installs the client libraries without the daemon.

MUST be re-evaluated if the pulseaudio package is ever added.

https://security-tracker.debian.org/tracker/CVE-2026-14330