========================================================================== Ubuntu Security Notice USN-8535-1 July 13, 2026
pipewire vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in PipeWire. Software Description: - pipewire: Low-latency, graph-based processing engine Details: It was discovered that PipeWire accepted unbounded Content-Length values in its RAOP module. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-14324) It was discovered that PipeWire performed multiple unbounded stack allocations in its PulseAudio protocol server. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-14330) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libpipewire-0.3-modules 1.6.2-1ubuntu1.1 libpipewire-0.3-modules-extra 1.6.2-1ubuntu1.1 libpipewire-0.3-modules-x11 1.6.2-1ubuntu1.1 libspa-0.2-modules 1.6.2-1ubuntu1.1 libspa-0.2-modules-extra 1.6.2-1ubuntu1.1 pipewire 1.6.2-1ubuntu1.1 pipewire-bin 1.6.2-1ubuntu1.1 pipewire-pulse 1.6.2-1ubuntu1.1 Ubuntu 24.04 LTS libpipewire-0.3-modules 1.0.5-1ubuntu3.3 libpipewire-0.3-modules-x11 1.0.5-1ubuntu3.3 libspa-0.2-modules 1.0.5-1ubuntu3.3 pipewire 1.0.5-1ubuntu3.3 pipewire-bin 1.0.5-1ubuntu3.3 pipewire-pulse 1.0.5-1ubuntu3.3 Ubuntu 22.04 LTS libpipewire-0.3-modules 0.3.48-1ubuntu3.2 libspa-0.2-modules 0.3.48-1ubuntu3.2 pipewire 0.3.48-1ubuntu3.2 pipewire-bin 0.3.48-1ubuntu3.2 pipewire-pulse 0.3.48-1ubuntu3.2 After a standard system update you need to restart pipewire to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8535-1 CVE-2026-14324, CVE-2026-14330 Package Information: https://launchpad.net/ubuntu/+source/pipewire/1.6.2-1ubuntu1.1 https://launchpad.net/ubuntu/+source/pipewire/1.0.5-1ubuntu3.3 https://launchpad.net/ubuntu/+source/pipewire/0.3.48-1ubuntu3.2
signature.asc
Description: OpenPGP digital signature
