Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-01T00:00:00 pipewire: RAOP RTSP NULL Deref 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-476

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Red Hat would like to thank Tristan for reporting this issue. If AirPlay streaming is not required, unload or disable the module-raop-discover and module-raop-sink PipeWire modules. Red Hat Enterprise Linux 10 Under investigation libkrun Red Hat Enterprise Linux 10 Under investigation pipewire Red Hat Enterprise Linux 8 Under investigation pipewire Red Hat Enterprise Linux 8 Under investigation pipewire0.2 Red Hat Enterprise Linux 9 Under investigation pipewire https://www.cve.org/CVERecord?id=CVE-2026-14324 https://nvd.nist.gov/vuln/detail/CVE-2026-14324