PipeWire EUVD-2026-41006

The PipeWire RAOP module must be loaded and active on the target system - this module enables AirPlay sink functionality and is not universally enabled by default on all RHEL deployments; it requires explicit configuration. The attacker must have network adjacency (same broadcast domain, VLAN, or subnet) as confirmed by AV:A in the CVSS vector - remote exploitation across routed network boundaries is not applicable. No authentication is required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to causing a crash (DoS); confidentiality and integrity of data are not affected. The non-default nature of the RAOP module is a meaningful real-world limiter: enterprise RHEL servers without AirPlay configuration are not exposed.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 6.5, reflecting that exploitation is constrained to the adjacent network segment rather than the open internet, which meaningfully limits the attacker pool in enterprise environments. Complexity is low and no authentication is required, meaning any host on the same broadcast domain or VLAN can trigger the crash. Impact is limited to availability - confidentiality and integrity are unaffected, reducing the business risk relative to the CVSS score might suggest in isolation. No EPSS score was provided; without it, quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, further reducing immediate real-world urgency. However, RHEL 8/9/10 are widely deployed enterprise platforms, and a DoS against PipeWire on a desktop or workstation disrupts all audio output (including conferencing, media, and accessibility tooling). The adjacent-network constraint is the primary limiting factor: environments with flat or poorly segmented networks face meaningfully higher risk.

An attacker positioned on the same network segment as a target RHEL workstation sends a crafted RTSP request to the PipeWire RAOP module with an extremely large Content-Length value. The module attempts to grow its internal pw_array without bounding the requested size, causing pw_array_add() to fail and return NULL; because the return is not checked, the subsequent dereference crashes the PipeWire daemon and silences all audio output on the target system. No public exploit code has been identified, but the attack is conceptually straightforward for anyone with adjacency and knowledge of the RTSP interface.