Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Pipewire: pulse server alloca stack overflow
Multiple unbounded alloca() calls in the PulseAudio protocol server.
References
Affected products
Matching in nixpkgs
pkgs.libkrun
Dynamic library providing Virtualization-based process isolation capabilities
pkgs.pipewire
Server and user space API to deal with multimedia pipelines
pkgs.libkrunfw
Dynamic library bundling the guest payload consumed by libkrun
pkgs.libkrun-efi
EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities
pkgs.libkrun-sev
Dynamic library providing Virtualization-based process isolation capabilities
pkgs.libkrun-tdx
Dynamic library providing Virtualization-based process isolation capabilities
pkgs.asha-pipewire-sink
Sample ASHA implementation for Linux designed to work with pipewire and bluez
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2025-05-20
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2025-05-20
pkgs.gpd-pocket-4-pipewire
Pipewire audio DSP for internal speakers of GPD Pocket 4
-
nixos-unstable -
- nixos-unstable-small 4-pipewire-0.0.1
-
nixos-26.05 -
- nixos-26.05-small 4-pipewire-0.0.1
pkgs.kdePackages.kpipewire
Components relating to Flatpak 'pipewire' use in Plasma.
pkgs.wayland-pipewire-idle-inhibit
Suspends automatic idling of Wayland compositors when media is being played through Pipewire
pkgs.gnomeExtensions.pipewire-settings
Top bar menu to set Pipewire's buffer size and samplerate
pkgs.gnomeExtensions.pipewire-airplay-toggle
Quick Setting menu toggle to enable/disable the RAOP Discover Module in PipeWire, allowing users to quickly and easily show or hide their AirPlay enabled speakers. This extension now also supports PulseAudio starting from version 8. For full details and dependency information, please review the GitHub repository wiki.
pkgs.obs-studio-plugins.obs-pipewire-audio-capture
Audio device and application capture for OBS Studio using PipeWire