CVE-2026-14324

RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

This vulnerability is rated as having a Moderate severity for Red Hat Enterprise Linux because exploitation requires an adjacent network attacker and is limited to causing a denial of service without compromising system integrity or confidentiality. PipeWire executes within an unprivileged user session, and RAOP functionality is not enabled in default configurations. Consequently, standard deployments remain unaffected unless users have specifically enabled AirPlay streaming endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If AirPlay streaming is not required, unload or disable the module-raop-discover and module-raop-sink PipeWire modules.