CVE-2009-1894: Pulseaudio

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.

Affected products

• Pulseaudio Pulseaudio: version 0.9.9 only; version 0.9.10 only; version 0.9.14 only

Published 2009-07-17. Last modified 2026-06-16.