CVE-2009-1894: Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors in...

Security readout for executives and security teams

CVE-2009-1894 is an old local privilege-escalation flaw in PulseAudio. A user who already has local access may be able to exploit a race condition to gain higher privileges. This is mainly a concern for legacy Linux systems still running the affected PulseAudio versions. Exposure is most likely on legacy Linux hosts or images running PulseAudio 0.9.9, 0.9.10, or 0.9.14. Modern systems are less likely to be affected, but old desktops, appliances, golden images, and unsupported distributions should be checked. Prioritize this where legacy Linux systems allow local user access, shared accounts, kiosks, labs, or multi-user desktops. It is not presented as remotely exploitable, but local privilege escalation can turn a low-privilege foothold into full system compromise. Mitigation focus: Inventory systems with PulseAudio installed.; Compare installed versions against 0.9.9, 0.9.10, and 0.9.14.; Apply the relevant Linux vendor PulseAudio security update..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.