Critical PipeWire Vulnerabilities Affect Ubuntu 24.04 LTS

Two critical vulnerabilities in PipeWire have been identified, affecting Ubuntu 24.04 LTS. The first vulnerability (CVE-2026-14324) allows a remote attacker to cause a denial of service by exploiting unbounded Content-Length values in the RAOP module. The second vulnerability (CVE-2026-14330) enables a local attacker to cause a denial of service through unbounded stack allocations in the PulseAudio protocol server. Both vulnerabilities were published on 2026-07-01. Users are advised to update their systems to the latest package versions to mitigate these risks. The vulnerabilities are specific to Ubuntu 24.04 LTS, with no mention of impact on other versions. The recommended action includes restarting PipeWire after the update to apply the changes.

Key Points: • Two critical vulnerabilities in PipeWire affect Ubuntu 24.04 LTS. • CVE-2026-14324 allows remote denial of service via unbounded Content-Length values. • CVE-2026-14330 enables local denial of service through unbounded stack allocations.