PulseAudio EUVD-2026-41007

Exploitation requires a local user session on the target RHEL system with the ability to connect to the PulseAudio protocol server socket (CVSS AV:L/PR:L confirmed). PulseAudio must be running - typical in RHEL desktop/workstation installations but absent in the vast majority of server deployments. Any user with a normal desktop session can ordinarily communicate with PulseAudio without elevated group membership or special permissions. There is no network-accessible attack surface. Exploitation is strictly limited to crashing the audio daemon (availability impact only); no code execution, privilege escalation, or data disclosure is achievable through this vulnerability in isolation. The primary limiting factors are the requirement for an existing local user account and PulseAudio being present and running.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (5.5 Medium) accurately characterizes the constrained real-world risk: exploitation is strictly local, requires only a standard user session, and produces no confidentiality or integrity impact - only a crash of the audio daemon. This is a meaningful risk in multi-user RHEL desktop environments or shared workstations where untrusted local users exist, but negligible in server deployments where PulseAudio is typically absent. EPSS score was not provided, so quantified exploitation probability is unavailable. The absence of a CISA KEV listing and no identified public exploit code further support a lower-urgency posture. The low attack complexity (AC:L) means that once local access is obtained there are no additional hurdles, but the local-only vector (AV:L) is the dominant limiting factor. Overall, this is a genuine but bounded DoS risk - prioritize patching on shared or multi-user desktop systems; server environments are likely unaffected.

A local attacker with a standard user account on a multi-user RHEL desktop system connects to the PulseAudio protocol socket and sends a crafted request containing an oversized length field. The daemon passes this unsanitized value to alloca(), instantly exhausting the thread's stack space, triggering a stack overflow that terminates the PulseAudio process and denies audio service to all active users. No public exploit code has been identified, but the straightforward nature of unvalidated alloca() makes the crash trivially reproducible once the specific protocol message and field are identified.