CVE-2026-14324

Pipewire: raop rtsp null deref

6.5 MediumFix available

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.31%Up 0.1 points since Jul 2, 2026

What each source reports

CVE List Score used 6.5

Pipewire: raop rtsp null deref

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: CVE-2026-14324
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-05

EUVDEUVD-2026-41006 6.5

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: EUVD-2026-41006
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-05

GitHub AdvisoriesGHSA-529g-ppv4-566r 6.5

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: GHSA-529g-ppv4-566r
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-04

NVD 6.5

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: CVE-2026-14324
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-05

OSVBELL-CVE-2026-14324 6.5

Record: BELL-CVE-2026-14324
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-14324 6.5

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: DEBIAN-CVE-2026-14324
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-05

Show 14 moreShow less

OSVOESA-2026-3114 6.5

pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities.

Security Fix(es):

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.(CVE-2026-14324)

Record: OESA-2026-3114
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3115 6.5

pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities.

Security Fix(es):

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.(CVE-2026-14324)

Record: OESA-2026-3115
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3116 6.5

pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities.

Security Fix(es):

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.(CVE-2026-14324)

Record: OESA-2026-3116
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:61240 6.5

Red Hat Security Advisory: pipewire security update

Record: RHSA-2026:61240
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:61241 6.5

Red Hat Security Advisory: pipewire security update

Record: RHSA-2026:61241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:61240 6.5

Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)
pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:61240
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:61241 6.5

Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:61241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-14324 6.5

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: UBUNTU-CVE-2026-14324
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2026:61240 No score

Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)
pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:61240
Updated: 2026-11-02

OSVALSA-2026:61241 No score

Moderate: pipewire security update

PipeWire is a multimedia server for Linux and other Unix like operating systems.

Security Fix(es):

pipewire: RAOP RTSP NULL Deref (CVE-2026-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:61241
Updated: 2026-11-02

OSVAZL-92015 No score

CVE-2026-14324 affecting package pipewire 0.3.60-3

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

Record: AZL-92015
Updated: 2026-11-05

OSVCLSA-2026-1788871614 No score

pipewire: Fix of 2 CVEs

CVE-2026-14324: RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return
CVE-2026-14330: Multiple unbounded alloca() calls in the PulseAudio protocol server

Record: CLSA-2026-1788871614
Updated: 2026-11-02

OSVMGASA-2026-0443 No score

Updated pipewire packages fix security vulnerabilities

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. (CVE-2026-14324) Multiple unbounded alloca() calls in the PulseAudio protocol server. (CVE-2026-14330)

Record: MGASA-2026-0443
Updated: 2026-11-02

OSVUSN-8535-1 No score

pipewire vulnerabilities

It was discovered that PipeWire accepted unbounded Content-Length values in its RAOP module. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-14324)

It was discovered that PipeWire performed multiple unbounded stack allocations in its PulseAudio protocol server. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-14330)

Record: USN-8535-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pipewire` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-alsa` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-devel` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-gstreamer` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit-devel` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit-libs` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-libs` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-module-x11` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire-pulseaudio` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2

Show 92 moreShow less

Affected packages
Package	Affected	Fixed
`pipewire-utils` AlmaLinux:9 From an advisory covering 2 CVEs	before 1.4.11-1.el9_8.2	1.4.11-1.el9_8.2
`pipewire` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-alsa` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-devel` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-gstreamer` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit-devel` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit-libs` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-libs` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-module-x11` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-plugin-libcamera` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-pulseaudio` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire-utils` AlmaLinux:10	before 1.4.11-1.el10_2.1	1.4.11-1.el10_2.1
`pipewire` Azure Linux:3	through 0.3.60-3	None known
`pipewire` Alpaquita:25	1.4.2-r0 up to 1.4.7-r1	1.4.7-r1
`pipewire` Alpaquita:stream	0.3.72-r0 up to 1.6.8-r0	1.6.8-r0
`pipewire` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-alsa` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-devel` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-doc` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-gstreamer` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-jack-audio-connection-kit` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-jack-audio-connection-kit-devel` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-jack-audio-connection-kit-libs` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-libs` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-module-x11` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-plugin-vulkan` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-pulseaudio` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-utils` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire-v4l2` TuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs	before 1.0.1-1.el9.tuxcare.els1	1.0.1-1.el9.tuxcare.els1
`pipewire` Debian:12	All versions, plus listed versions 0.3.65-30.3.65-3+deb12u10.3.66-10.3.67-10.3.67-2 Show 45 moreShow less 0.3.68-10.3.69-10.3.70-10.3.70-20.3.71-10.3.71-20.3.72-10.3.72-20.3.73-10.3.74-10.3.74-1~bpo11+10.3.74-1~bpo12+10.3.76-10.3.76-1~bpo11+10.3.76-1~bpo12+10.3.77-10.3.77-1~bpo11+10.3.77-1~bpo12+10.3.78-10.3.79-10.3.79-1~bpo11+10.3.79-1~bpo12+10.3.79-20.3.80-10.3.80-20.3.80-2~bpo11+10.3.80-2~bpo12+10.3.81-10.3.82-10.3.82-1~bpo11+10.3.82-1~bpo12+10.3.83-10.3.83-1~bpo11+10.3.83-1~bpo12+10.3.84-10.3.84-1~bpo12+10.3.85-10.3.85-1~bpo11+10.3.85-1~bpo12+11.0.0-11.0.0-1~bpo11+11.0.0-1~bpo12+11.0.0-21.0.0-31.0.1-1	None known
`pipewire` Debian:13	All versions, plus listed versions 1.4.10-11.4.2-11.4.3-11.4.4-11.4.5-1 Show 25 moreShow less 1.4.6-11.4.7-11.4.7-21.4.7-31.4.7-3~bpo13+11.4.8-11.4.9-11.4.9-1~bpo13+11.4.9-1~bpo13+21.5.81-11.5.83-11.5.84-11.5.85-11.6.0-11.6.1-11.6.2-11.6.3-11.6.4-11.6.5-11.6.6-11.6.7-11.6.8-11.6.9-11.6.9-21.6.9-2~bpo13+1	None known
`pipewire` Debian:14	before 1.6.8-1, plus listed versions 1.4.10-11.4.2-11.4.3-11.4.4-11.4.5-1 Show 21 moreShow less 1.4.6-11.4.7-11.4.7-21.4.7-31.4.7-3~bpo13+11.4.8-11.4.9-11.4.9-1~bpo13+11.4.9-1~bpo13+21.5.81-11.5.83-11.5.84-11.5.85-11.6.0-11.6.1-11.6.2-11.6.3-11.6.4-11.6.5-11.6.6-11.6.7-1	1.6.8-1
`pipewire` Mageia:10 From an advisory covering 2 CVEs	before 1.6.5-1.1.mga10	1.6.5-1.1.mga10
`pipewire` Mageia:9 From an advisory covering 2 CVEs	before 0.3.85-6.1.mga9	0.3.85-6.1.mga9
`pipewire` openEuler:24.03-LTS-SP3	before 0.3.63-6.oe2403sp3	0.3.63-6.oe2403sp3
`pipewire` openEuler:24.03-LTS-SP4	before 0.3.63-6.oe2403sp4	0.3.63-6.oe2403sp4
`pipewire` openEuler:24.03-LTS-SP1	before 0.3.63-6.oe2403sp1	0.3.63-6.oe2403sp1
`pipewire` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-alsa` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-alsa-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-gstreamer` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-gstreamer-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit-libs` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-jack-audio-connection-kit-libs-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-libs` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-libs-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-module-x11` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-module-x11-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-plugin-vulkan-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-pulseaudio` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-pulseaudio-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-utils` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-utils-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire-v4l2-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-alsa` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-alsa-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-debugsource` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-devel` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-gstreamer` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-gstreamer-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit-devel` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit-libs` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-jack-audio-connection-kit-libs-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-libs` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-libs-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-module-x11` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-module-x11-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-plugin-libcamera` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-plugin-libcamera-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-plugin-vulkan-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-pulseaudio` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-pulseaudio-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-utils` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-utils-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire-v4l2-debuginfo` Red Hat:enterprise_linux:10.2	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire` Rocky Linux:9 From an advisory covering 2 CVEs	before 0:1.4.11-1.el9_8.2	0:1.4.11-1.el9_8.2
`pipewire` Rocky Linux:10	before 0:1.4.11-1.el10_2.1	0:1.4.11-1.el10_2.1
`pipewire` Ubuntu:24.04:LTS	before 1.0.5-1ubuntu3.3, plus listed versions 0.3.79-20.3.83-10.3.84-10.3.85-11.0.0-1ubuntu1 Show 13 moreShow less 1.0.1-1ubuntu21.0.1-1ubuntu31.0.2-1ubuntu11.0.3-1ubuntu21.0.4-2ubuntu21.0.4-2ubuntu31.0.4-2ubuntu41.0.5-11.0.5-1ubuntu11.0.5-1ubuntu21.0.5-1ubuntu31.0.5-1ubuntu3.11.0.5-1ubuntu3.2	1.0.5-1ubuntu3.3
`pipewire` Ubuntu:25.10	All versions, plus listed versions 1.2.7-1ubuntu51.2.7-1ubuntu61.4.2-1ubuntu31.4.2-1ubuntu41.4.5-1ubuntu11.4.5-1ubuntu21.4.7-3ubuntu11.4.7-3ubuntu2	None known
`pipewire` Ubuntu:26.04:LTS	before 1.6.2-1ubuntu1.1, plus listed versions 1.4.7-3ubuntu21.4.9-1ubuntu11.5.84-1ubuntu21.6.0-1ubuntu21.6.2-1ubuntu1	1.6.2-1ubuntu1.1
`pipewire` Ubuntu:22.04:LTS From an advisory covering 2 CVEs	before 0.3.48-1ubuntu3.2, plus listed versions 0.3.32-10.3.39-40.3.40-10.3.40-20.3.41-1ubuntu1 Show 8 moreShow less 0.3.42-10.3.43-20.3.44-10.3.45-10.3.47-1ubuntu10.3.48-1ubuntu10.3.48-1ubuntu20.3.48-1ubuntu3	0.3.48-1ubuntu3.2
`pipewire` Ubuntu:24.04:LTS From an advisory covering 2 CVEs	before 1.0.5-1ubuntu3.3, plus listed versions 0.3.79-20.3.83-10.3.84-10.3.85-11.0.0-1ubuntu1 Show 13 moreShow less 1.0.1-1ubuntu21.0.1-1ubuntu31.0.2-1ubuntu11.0.3-1ubuntu21.0.4-2ubuntu21.0.4-2ubuntu31.0.4-2ubuntu41.0.5-11.0.5-1ubuntu11.0.5-1ubuntu21.0.5-1ubuntu31.0.5-1ubuntu3.11.0.5-1ubuntu3.2	1.0.5-1ubuntu3.3
`pipewire` Ubuntu:26.04:LTS From an advisory covering 2 CVEs	before 1.6.2-1ubuntu1.1, plus listed versions 1.4.7-3ubuntu21.4.9-1ubuntu11.5.84-1ubuntu21.6.0-1ubuntu21.6.2-1ubuntu1	1.6.2-1ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	CVE List, EUVD, GitHub Advisories, NVD, OSV
Nov 4, 2026	products, references	CVE List, EUVD, NVD, OSV
Nov 3, 2026	facts, products, references	CVE List, GitHub Advisories, NVD
Nov 3, 2026	products, references	CVE List, EUVD, GitHub Advisories
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14324 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in pipewire 1.4.11-1.el10_2.1.

References

Show 29 moreShow less

This page doesn't list everything

Left out here: 71 versions. The JSON record has them.