{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://gitlab.freedesktop.org/pipewire/pipewire","packageName":"pipewire","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThanOrEqual":"1.6.8","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.4.11-1.el10_2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.7-1.el10_0.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.4.11-1.el9_8","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.3.47-4.el9_2.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.1-1.el9_4.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.1-1.el9_6.1","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pipewire0.2","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"firefox","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-5674","cwes":["CWE-427"],"description":"A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.","epss":{"date":"2026-11-04","percentile":0.08213,"score":0.00185},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793834275240,"publishedAt":1784208404534,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:47082"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:47083"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:51064"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:56028"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:56029"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:61768"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-5674"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455341"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:47082"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:47083"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:51064"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:56028"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:56029"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:61768"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-5674"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455341"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"To mitigate this issue, restrict containerized applications from accessing the PulseAudio socket or writing to host-visible paths. Additionally, configure PipeWire to prevent module loading by setting `pulse.allow-module-loading = false` in the PipeWire PulseAudio configuration. Alternatively, restrict the `dlopen()` paths for `module-ladspa-sink` to trusted system directories like `/usr/lib/ladspa/` and `/usr/lib64/ladspa/`. Applying these changes may require restarting the PipeWire service to take effect, which could impact audio functionality."}],"revision":"2d1f4181a06222826124c8550fddc0d799bc0514cb921af9fad160df8013babd","sources":[{"modifiedAt":1793832592584,"name":"CNA: redhat","retrievedAt":1793833906391,"url":"https://www.cve.org/CVERecord?id=CVE-2026-5674"},{"modifiedAt":1793834275240,"name":"NVD","retrievedAt":1793838033415,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5674"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793833913495,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-5674"}],"ssvc":{"assessedAt":1784210569819,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading","updatedAt":1793838033415}