Red Hat Security Advisory: pipewire security update

PipeWire, a multimedia server used on Linux and Unix-like operating systems, has two identified security vulnerabilities: CVE-2026-14324, a NULL pointer dereference in the RAOP RTSP component, and CVE-2026-14330, a stack overflow in the Pulse Server alloca function. Both vulnerabilities have been rated as moderate severity by Red Hat Product Security. Red Hat has issued security advisories and updates for Red Hat Enterprise Linux 9 and its extended support variants to address these issues. The advisory references Bugzilla entries BZ-2495903 and BZ-2495907 for the respective CVEs. No CVSS base scores are provided in the advisory. No evidence of exploitation in the wild has been reported. The update is available as pipewire-1.4.11-1.el9_8.2 and related packages.

The vulnerabilities could cause application crashes or memory corruption due to NULL pointer dereference and stack overflow conditions in PipeWire components. This may affect the stability and security of multimedia services relying on PipeWire. No reports of active exploitation exist, and the impact is rated moderate by the vendor.

Red Hat has released security updates for PipeWire in Red Hat Enterprise Linux 9 and related variants. Users should apply the updates described in Red Hat advisory RHSA-2026:61240 to remediate these vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor.