Summary
It was discovered that PipeWire accepted unbounded Content-Length values
in its RAOP module. A remote attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-14324)
It was discovered that PipeWire performed multiple unbounded stack
allocations in its PulseAudio protocol server. A local attacker could
possibly use this issue to cause a denial of service. (CVE-2026-14330)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pipewire | 0.3.48-1ubuntu3.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | pipewire | 1.0.5-1ubuntu3.3 |
| Ubuntu · 26.04 LTS 26.04:LTS | pipewire | 1.6.2-1ubuntu1.1 |
Vulnerabilities 2
-
Medium 6.5
Pipewire: raop rtsp null deref
RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
-
Medium 5.5
Pipewire: pulse server alloca stack overflow
Multiple unbounded alloca() calls in the PulseAudio protocol server.