Back Linuxsecurity

Ubuntu 26.04 PipeWire Critical Denial of Service Vuln USN-8535

Linuxsecurity •LinuxSecurity Advisories • July 13, 2026

Several security issues were fixed in PipeWire. Software Description: - pipewire: Low-latency, graph-based processing engine Details: It was discovered that PipeWire accepted unbounded Content-Length values in its RAOP module. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-14324) It was discovered that PipeWire performed multiple unbounded stack allocations in its PulseAudio protocol server. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-14330)

Several security issues were fixed in PipeWire.

Software Description:

- pipewire: Low-latency, graph-based processing engine

It was discovered that PipeWire accepted unbounded Content-Length values

in its RAOP module. A remote attacker could possibly use this issue to cause

a denial of service. This issue only affected Ubuntu 24.04 LTS.

It was discovered that PipeWire performed multiple unbounded stack

allocations in its PulseAudio protocol server. A local attacker could

possibly use this issue to cause a denial of service. (CVE-2026-14330)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libpipewire-0.3-modules 1.6.2-1ubuntu1.1 libpipewire-0.3-modules-extra 1.6.2-1ubuntu1.1 libpipewire-0.3-modules-x11 1.6.2-1ubuntu1.1 libspa-0.2-modules 1.6.2-1ubuntu1.1 libspa-0.2-modules-extra 1.6.2-1ubuntu1.1 pipewire 1.6.2-1ubuntu1.1 pipewire-bin 1.6.2-1ubuntu1.1 pipewire-pulse 1.6.2-1ubuntu1.1 Ubuntu 24.04 LTS libpipewire-0.3-modules 1.0.5-1ubuntu3.3 libpipewire-0.3-modules-x11 1.0.5-1ubuntu3.3 libspa-0.2-modules 1.0.5-1ubuntu3.3 pipewire 1.0.5-1ubuntu3.3 pipewire-bin 1.0.5-1ubuntu3.3 pipewire-pulse 1.0.5-1ubuntu3.3 Ubuntu 22.04 LTS libpipewire-0.3-modules 0.3.48-1ubuntu3.2 libspa-0.2-modules 0.3.48-1ubuntu3.2 pipewire 0.3.48-1ubuntu3.2 pipewire-bin 0.3.48-1ubuntu3.2 pipewire-pulse 0.3.48-1ubuntu3.2 After a standard system update you need to restart pipewire to make all the necessary changes.

CVE-2026-14324, CVE-2026-14330

Ubuntu Security Notice USN-8535-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PipeWire Vulnerabilities Affect Ubuntu 24.04 LTS Two critical vulnerabilities in PipeWire have been identified, affecting Ubuntu 24.04 LTS. The first vulnerability (CVE-2026-14324) allows a remote attacker to cause a denial of service by exploiting unbounded Content-Length values in the RAOP module. The second vulnerability (CVE-2026-14330) enables a local attacker to cause a denial of service through unbounded stack allocations in the PulseAudio protocol server. Both vulnerabilities were published on 2026-07-01. Users are advised to update their systems to the latest package versions to mitigate these risks. The vulnerabilities are specific to Ubuntu 24.04 LTS, with no mention of impact on other versions. The recommended action includes restarting PipeWire after the update to apply the changes. 2 sources 71

Extracted Entities

Ubuntu 26.04 PipeWire Critical Denial of Service Vuln USN-8535

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)