{"id":"CVE-2026-5674","state":"PUBLISHED","title":"Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading","description":"A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.","publishedAt":"2026-07-16T13:26:44.534Z","updatedAt":"2026-08-31T19:51:13.024Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["pipewire","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8"],"affected":[{"packageName":"pipewire","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.6.8","versionType":"semver"}],"collectionURL":"https://gitlab.freedesktop.org/pipewire/pipewire"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.4.11-1.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.2.7-1.el10_0.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.4.11-1.el9_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:0.3.47-4.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.0.1-1.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.0.1-1.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libkrun","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pipewire","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pipewire0.2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:47082","https://access.redhat.com/errata/RHSA-2026:47083","https://access.redhat.com/errata/RHSA-2026:51064","https://access.redhat.com/errata/RHSA-2026:56028","https://access.redhat.com/errata/RHSA-2026:56029","https://access.redhat.com/errata/RHSA-2026:61768","https://access.redhat.com/security/cve/CVE-2026-5674","https://bugzilla.redhat.com/show_bug.cgi?id=2455341"],"weaknesses":["CWE-427"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5674.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5674","state":"PUBLISHED","datePublished":"2026-07-16T13:26:44.534Z","dateUpdated":"2026-08-31T19:51:13.024Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-04-06T09:07:33.494Z"},"containers":{"cna":{"title":"Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading","descriptions":[{"lang":"en","value":"A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system."}],"affected":[{"packageName":"pipewire","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.6.8","versionType":"semver"}],"collectionURL":"https://gitlab.freedesktop.org/pipewire/pipewire"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.4.11-1.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.2.7-1.el10_0.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.4.11-1.el9_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:0.3.47-4.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.0.1-1.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"pipewire","defaultStatus":"affected","versions":[{"version":"0:1.0.1-1.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libkrun","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pipewire","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pipewire0.2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"firefox","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:47082","name":"RHSA-2026:47082","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47083","name":"RHSA-2026:47083","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51064","name":"RHSA-2026:51064","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56028","name":"RHSA-2026:56028","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56029","name":"RHSA-2026:56029","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61768","name":"RHSA-2026:61768","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5674","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455341","name":"RHBZ#2455341","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-427","description":"Uncontrolled Search Path Element","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-08-31T19:51:13.024Z"},"datePublic":"2026-07-04T23:59:00.000Z","x_redhatCweChain":"CWE-427: Uncontrolled Search Path Element","workarounds":[{"lang":"en","value":"To mitigate this issue, restrict containerized applications from accessing the PulseAudio socket or writing to host-visible paths. Additionally, configure PipeWire to prevent module loading by setting `pulse.allow-module-loading = false` in the PipeWire PulseAudio configuration. Alternatively, restrict the `dlopen()` paths for `module-ladspa-sink` to trusted system directories like `/usr/lib/ladspa/` and `/usr/lib64/ladspa/`. Applying these changes may require restarting the PipeWire service to take effect, which could impact audio functionality."}],"timeline":[{"lang":"en","time":"2026-04-06T09:14:25.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-07-04T23:59:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Johann Rehberger (embracethered.com) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-16T14:02:49.819208Z","id":"CVE-2026-5674","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-16T14:03:16.054Z"}}]}}}