PipeWire versions prior to 0.3.63-7.oe2403sp1 contain multiple unbounded alloca() calls in the PulseAudio protocol server, leading to a vulnerability (CVE-2026-14330). This flaw allows an attacker with minimal permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by exploiting PipeWire's PulseAudio compatibility layer. The attacker can load a malicious library, resulting in arbitrary code execution outside the sandbox and potential full compromise of the user's system. A fix is available in version 0.3.63-7.oe2403sp1.