A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

A flaw was found in PipeWire's PulseAudio protocol server. Multiple functions use alloca() without bounds checking to allocate arrays based on counts from card parameters or client properties. A malicious PulseAudio client can trigger stack exhaustion by sending requests with very large parameter counts, crashing the PipeWire daemon.

A flaw was found in PipeWire's RAOP (AirPlay) RTSP client. The client does not validate Content-Length values from remote servers and does not check the return value of memory allocation functions. A rogue AirPlay device on the local network can send a crafted RTSP response with an extremely large Content-Length, causing a NULL pointer dereference and crashing the PipeWire daemon.