CVE-2026-5674: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-5674 is a sandbox escape vulnerability in PipeWire, a multimedia server for Linux, that allows an attacker with minimal permissions inside a sandboxed environment (such as Flatpak) to load a malicious shared library via PipeWire's PulseAudio compatibility layer, resulting in arbitrary code execution outside the sandbox. The flaw affects PipeWire versions up to and including 1.0.5 and was reported to Red Hat on April 6, 2026, with public disclosure on July 16, 2026. It has been confirmed on Ubuntu 24.04 (x86_64) and Debian 13 (aarch64). The CVSS v3.1 base score is 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an Uncontrolled Search Path Element (CWE-427) in two PipeWire modules: module-protocol-pulse (pulse-server.c) and module-ladspa-sink (plugin_ladspa.c). The module-ladspa-sink plugin accepts an arbitrary filesystem path for a LADSPA plugin via the PA_COMMAND_LOAD_MODULE PulseAudio protocol command and passes it directly to dlopen() without validating or restricting the path to trusted directories such as /usr/lib/ladspa/. An attacker operating within a sandboxed application that has --socket=pulseaudio and write access to any host-visible path (e.g., --filesystem=/tmp/share/) can place a malicious .so file on the host filesystem and instruct PipeWire — running outside the sandbox with full user context — to load it. No authentication of the PulseAudio cookie is performed before honoring the module load request (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows a local attacker with minimal sandbox permissions to fully escape the sandbox and execute arbitrary code in the host user's context, achieving high confidentiality, integrity, and availability impact on the host system. Because the code executes as the user running PipeWire (typically the logged-in desktop user), the attacker gains access to all user data, credentials, and session resources outside the sandbox boundary. The changed scope (S:C in CVSS) reflects that the impact extends beyond the sandboxed component to the broader host user session (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.12% (3rd percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only low privileges and no user interaction, and the technique is well-understood (shared library injection via dlopen()), making weaponization straightforward for a motivated attacker with access to a vulnerable Flatpak environment (Red Hat Bugzilla).

1. Identify a vulnerable target: Confirm the target system runs PipeWire ≤ 1.0.5 with the PulseAudio compatibility layer enabled and that a Flatpak (or similar sandbox) application is installed with --socket=pulseaudio and write access to a host-visible path (e.g., --filesystem=/tmp/wuzzi:create).
2. Craft a malicious shared library: Compile a .so file containing an ELF constructor (__attribute__((constructor))) that executes the desired payload (e.g., a reverse shell or file exfiltration command) when loaded via dlopen().
3. Drop the payload onto the host filesystem: From within the sandboxed application, write the compiled .so to the host-visible path, e.g., /tmp/wuzzi/payload.so.
4. Connect to the PulseAudio socket: From within the sandbox, open a connection to the PipeWire PulseAudio compatibility socket (typically at /run/user/<UID>/pulse/native).
5. Authenticate with arbitrary bytes: Send a PA_COMMAND_AUTH message with 256 arbitrary bytes — no valid cookie validation is enforced, so authentication succeeds.
6. Send PA_COMMAND_LOAD_MODULE: Issue a PA_COMMAND_LOAD_MODULE request specifying module-ladspa-sink with the parameter plugin=/tmp/wuzzi/payload.so.
7. Trigger sandbox escape: PipeWire (running outside the sandbox) calls dlopen("/tmp/wuzzi/payload.so", ...), executing the ELF constructor in the full host user context, completing the sandbox escape (Red Hat Bugzilla, Embrace The Red).

• Process: Unexpected child processes spawned by the PipeWire daemon (e.g., bash, sh, curl, wget, python) that are not typical audio processing children.
• File System: Presence of unexpected .so files in world-writable or /tmp-based directories (e.g., /tmp/*/payload.so); new or modified files in the user's home directory created around the time of PipeWire activity.
• Logs: System journal (journalctl) entries showing PipeWire loading a LADSPA plugin from an unusual path outside /usr/lib/ladspa/ or /usr/lib64/ladspa/; dlopen errors or successes referencing /tmp or user-writable paths in PipeWire logs.
• Network: Unexpected outbound network connections originating from the PipeWire process or its children to external IP addresses, particularly shortly after a Flatpak application connects to the PulseAudio socket.
• Audit: Linux audit log (auditd) events showing openat or mmap syscalls by the PipeWire process on .so files located outside standard library directories (Red Hat Bugzilla, Embrace The Red).

Red Hat has released patched packages for RHEL 9 (RHSA-2026:47082) and RHEL 10 (RHSA-2026:47083), with the fixed version being pipewire-1.4.11-1.el10_2 for RHEL 10. Upstream PipeWire users should upgrade to a version beyond 1.0.5 once available from their distribution. If immediate patching is not possible, three mitigations can independently break the attack chain: (1) set pulse.allow-module-loading = false in the PipeWire PulseAudio configuration (available since May 2024); (2) restrict dlopen() paths in module-ladspa-sink to /usr/lib/ladspa/ and /usr/lib64/ladspa/; or (3) validate the PulseAudio cookie against ~/.config/pulse/cookie before honoring module load requests. As a deployment-level workaround, avoid granting Flatpak applications both --socket=pulseaudio and write access to any host-visible filesystem path simultaneously (Red Hat Errata RHSA-2026:47083, Red Hat Bugzilla).

A detailed technical write-up was published by the researcher who discovered the vulnerability on the Embrace The Red blog, describing the full exploitation technique and confirming it on Ubuntu 24.04 and Debian 13 (Embrace The Red). The vulnerability was discussed on Reddit's r/SecOpsDaily and received coverage from the German Linux security news site pro-linux.de. The security community noted the significance of the attack requiring only minimal Flatpak permissions, making it relevant to a broad range of desktop Linux users who install Flatpak applications with audio access.