CVE-2009-1894
HIGH · CVSS 7.2EPSS 0.7%EU EUVD
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
Key facts
- CVSS score
- 7.2 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:L/AC:L/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-362
- EPSS score
- 0.7% (55th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-1889)
- Published
- July 17, 2009
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-1889 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- pulseaudio / pulseaudio
- pulseaudio / pulseaudio
- pulseaudio / pulseaudio
References
- http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html
- http://secunia.com/advisories/35868
- http://secunia.com/advisories/35886
- http://secunia.com/advisories/35896
- http://security.gentoo.org/glsa/glsa-200907-13.xml
- http://taviso.decsystem.org/research.html
- http://www.akitasecurity.nl/advisory.php?id=AK20090602
- http://www.debian.org/security/2009/dsa-1838
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:152
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:171
- http://www.securityfocus.com/archive/1/505052/100/0/threaded
- http://www.securityfocus.com/bid/35721(Exploit, Patch)
- http://www.ubuntu.com/usn/usn-804-1
- https://admin.fedoraproject.org/updates/pulseaudio-0.9.10-1.el5.2
- https://bugzilla.redhat.com/show_bug.cgi?id=510071(Exploit, Patch)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51804
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain