CVE-2026-5674

EUVD-2026-44925
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.66%
Debian logo
Debian Releases
Debian Product
Codename
pipewire
bookworm
vulnerable
bullseye
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pipewire
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
pipewire
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-alsa
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-devel
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-gstreamer
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-jack-audio-connection-kit
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-jack-audio-connection-kit-devel
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-jack-audio-connection-kit-libs
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-libs
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-module-x11
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-pulseaudio
RHEL 9
0:1.4.11-1.el9_8
fixed
pipewire-utils
RHEL 9
0:1.4.11-1.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
pipewire
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-alsa
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-alsa-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-config-rates
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-config-upmix
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-debugsource
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-devel
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-doc
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-gstreamer
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-gstreamer-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-devel
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-libs
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-jack-audio-connection-kit-libs-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-libs
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-libs-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-module-x11
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-module-x11-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-plugin-vulkan
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-plugin-vulkan-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-pulseaudio
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-pulseaudio-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-utils
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-utils-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-v4l2
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
pipewire-v4l2-debuginfo
Amazon Linux 2023
0:1.2.7-4.amzn2023.0.5
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:47082
https://access.redhat.com/errata/RHSA-2026:47083
https://access.redhat.com/errata/RHSA-2026:51064
https://access.redhat.com/errata/RHSA-2026:56028
https://access.redhat.com/errata/RHSA-2026:56029
https://access.redhat.com/security/cve/CVE-2026-5674
https://bugzilla.redhat.com/show_bug.cgi?id=2455341