CVE-2026-14324: Pipewire: raop rtsp null deref
A flaw was found in PipeWire's RAOP (AirPlay) RTSP client. The client does not validate Content-Length values from remote servers and does not check the return value of memory allocation functions. A rogue AirPlay device on the local network can send a crafted RTSP response with an extremely large Content-Length, causing a NULL pointer dereference and crashing the PipeWire daemon.
Other sources
RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd() return.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pipewireto a version that resolves this vulnerability.Fixed in 0.3.19-4Fixed in 1.6.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14324?
The severity of CVE-2026-14324 is rated as medium with a score of 6.5.
How do I fix CVE-2026-14324?
To fix CVE-2026-14324, you should update PipeWire to the latest version available that addresses the vulnerability.
What type of vulnerability is CVE-2026-14324?
CVE-2026-14324 is classified as a null pointer dereference vulnerability within the PipeWire RAOP RTSP client.
What are the potential risks of CVE-2026-14324?
The potential risks of CVE-2026-14324 include the possibility of a rogue AirPlay device exploiting the vulnerability to crash the RTSP client.
In which component can CVE-2026-14324 be found?
CVE-2026-14324 can be found in the PipeWire RAOP RTSP client.