Description
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pulseaudio | 5.0-3 | — |
| Debian 13 | pulseaudio | 5.0-3 | — |
| Debian 12 | pulseaudio | 5.0-3 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pulseaudio | 9.0-2.3 | openSUSE-SU-2024:10241-1 |
Advisories 1
- openSUSE-SU-2024:10241-1 libpulse-devel-32bit-9.0-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 67814 vdb-entry
- MDVSA-2015:134 vendor-advisory
- [oss-security] 20140604 CVE request: PulseAudio crash due to empty UDP packet mailing-list
- [pulseaudio-discuss] 20140531 Remotely triggerable crash in module-rtp-recv mailing-list
- http://advisories.mageia.org/MGASA-2014-0440.html
- 60624 third-party-advisory
- [oss-security] 20140604 Re: CVE request: PulseAudio crash due to empty UDP packet mailing-list