Executive brief
A vulnerability exists in PipeWire, a core Linux service responsible for handling audio and video streams. An attacker using a malicious AirPlay-compatible device on the same local network can send specially crafted data to crash the PipeWire service. This results in a loss of audio and video functionality for the affected user, potentially disrupting communications or media playback.
Technical details
A flaw was identified in the PipeWire RAOP (Remote Audio Output Protocol) RTSP client module. The component fails to validate 'Content-Length' headers in RTSP responses from remote servers and neglects to check the return value of the 'pw_array_add()' function. An attacker on the local network (adjacent) can simulate a rogue AirPlay device and send a response with an excessively large Content-Length. This leads to a failed memory allocation and a subsequent NULL pointer dereference (CWE-476), resulting in a denial-of-service (DoS) condition by crashing the PipeWire daemon.
Affected products
- Red Hat Enterprise Linux 8 pipewire, pipewire0.2
- Red Hat Enterprise Linux 9 pipewire
- Red Hat Enterprise Linux 10 pipewire, libkrun
Timeline
- 2026-07-01: disclosed: Initial report via Red Hat Bugzilla and NVD publication.
- 2026-07-01: advisory