A flaw was found in PipeWire

CVE-2026-5674 is an uncontrolled search path element (CWE-427) in PipeWire's pipewire-pulse PulseAudio compatibility layer. When a Flatpak-sandboxed application connects to the PulseAudio socket served by PipeWire, the service resolves shared libraries using a search path that the sandboxed process can influence. A malicious or compromised Flatpak app can place a crafted .so in a writable path, and PipeWire will load it outside the sandbox boundary, giving the attacker user-level code execution on the host. All current PipeWire releases are affected — Debian tracks versions from 0.3.65 through 1.6.8, and no upstream fix has been released yet. RHEL 9, Fedora 38+, Ubuntu 22.10+, and Debian Trixie all ship PipeWire as the default audio server on desktop installations.

The vendor's HIGH / 8.8 rating reflects the real scope-change math: the CVSS vector correctly captures S:C because the attack crosses the Flatpak sandbox boundary. But the score overstates the risk to a typical 10,000-host enterprise. PipeWire is a *desktop multimedia daemon* — it does not run on headless servers, domain controllers, hypervisors, or CI/CD runners. The attack requires the victim to already be running a malicious or compromised Flatpak app, and the escape yields user-context execution, not root. For most enterprise fleets where Linux desktops are a single-digit percentage of the estate and Flatpak adoption is limited to developer workstations, the real-world exposure is narrow enough to justify a downgrade to MEDIUM.

Why this verdict

• Attack prerequisite narrows population: The attacker must already have code running inside a Flatpak sandbox on the target host. This implies either a supply-chain compromise of a Flatpak app or social engineering of a desktop user — not a remotely exploitable condition.
• Role multiplier — no high-value role applies: PipeWire is a desktop audio/video daemon. It does not run on domain controllers, hypervisors, backup servers, CI/CD runners, network edge appliances, or any fleet-critical infrastructure component. The blast radius of successful exploitation is a single user's desktop session (host-level, user-context). This places it firmly in category (a) low-value role.
• User-context only, no privilege escalation: The sandbox escape yields code execution as the logged-in desktop user, not root. The attacker cannot directly pivot to other hosts or escalate to system-level without a separate privesc vulnerability.
• No exploitation evidence or PoC: EPSS is 0.00125, no KEV listing, no public PoC, and no observed campaigns. Weaponization friction is currently high.
• Enterprise Linux desktop population is small: In a typical 10,000-host enterprise, Linux desktops represent <10% of endpoints, and Flatpak usage is concentrated on developer workstations — further narrowing the exposed population to low single-digit percentages.

Why not higher?

There is no high-value-role deployment scenario for PipeWire — it is not a hypervisor, identity provider, backup system, or network edge appliance. The attack requires pre-existing sandboxed code execution (not remote access), yields only user-context permissions, and has no public PoC or exploitation evidence. No floor-raising condition from the role catalog applies.

Why not lower?

The sandbox escape is real and architecturally significant — Flatpak's security model depends on containment, and this bug breaks it. On developer workstations with cloud credentials, SSH keys, and source code, the user-context blast radius is meaningful. The scope change (S:C) in the CVSS vector is legitimate. Additionally, no patch exists yet, meaning defenders cannot fully remediate even if they want to.

1. Audit and restrict Flatpak installations — Run flatpak list --app across your Linux desktop fleet and remove untrusted or unnecessary apps. Restrict Flatpak installs to curated repos via policy. This eliminates the primary attack entry point. No mitigation SLA applies for MEDIUM — fold this into your 365-day remediation cycle.
2. Enable SELinux enforcing on RHEL/Fedora desktops — SELinux's pipewire_t domain transitions can block dlopen() from user-writable directories, preventing the library hijack even without a patch. Verify with sesearch -A -s pipewire_t -p open that no allow rule grants access to attacker-controlled paths.
3. Deploy file-integrity monitoring on PipeWire paths — Add AIDE or osquery rules monitoring ~/.local/share/pipewire/, /usr/lib/pipewire-*, and XDG runtime directories for unexpected .so files. Alert on any new shared object in these paths.
4. Fall back to native PulseAudio where possible — If pipewire-pulse is not needed for Flatpak audio, switch affected desktops to native PulseAudio (systemctl --user disable pipewire-pulse && systemctl --user enable pulseaudio). This removes the vulnerable component entirely.

Run this script on each Linux desktop host you want to check. Execute as the logged-in desktop user (no root needed): bash check_cve_2026_5674.sh. It checks whether pipewire-pulse is installed and running, and whether any Flatpak apps are present — both conditions required for exploitation.

#!/usr/bin/env bash
# check_cve_2026_5674.sh — CVE-2026-5674 PipeWire sandbox escape exposure check
# Run as the desktop user. No root required.
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

VULNERABLE=0
PATCHED=0
UNKNOWN=0

# Check if pipewire-pulse is installed
PW_PULSE_INSTALLED=false
if command -v pipewire-pulse >/dev/null 2>&1; then
    PW_PULSE_INSTALLED=true
elif dpkg -l pipewire-pulse 2>/dev/null | grep -q '^ii'; then
    PW_PULSE_INSTALLED=true
elif rpm -q pipewire-pulseaudio >/dev/null 2>&1; then
    PW_PULSE_INSTALLED=true
fi

# Check if pipewire-pulse is running
PW_PULSE_RUNNING=false
if pgrep -x pipewire-pulse >/dev/null 2>&1; then
    PW_PULSE_RUNNING=true
elif systemctl --user is-active pipewire-pulse.service >/dev/null 2>&1; then
    PW_PULSE_RUNNING=true
fi

# Check if Flatpak is installed and apps are present
FLATPAK_APPS=false
if command -v flatpak >/dev/null 2>&1; then
    APP_COUNT=$(flatpak list --app 2>/dev/null | wc -l)
    if [ "$APP_COUNT" -gt 0 ]; then
        FLATPAK_APPS=true
    fi
fi

# Get PipeWire version
PW_VERSION="unknown"
if command -v pipewire >/dev/null 2>&1; then
    PW_VERSION=$(pipewire --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "unknown")
fi

echo "=== CVE-2026-5674 Exposure Check ==="
echo "PipeWire version:      $PW_VERSION"
echo "pipewire-pulse installed: $PW_PULSE_INSTALLED"
echo "pipewire-pulse running:   $PW_PULSE_RUNNING"
echo "Flatpak apps present:     $FLATPAK_APPS"
echo ""

# No patch exists yet — all versions with pipewire-pulse are vulnerable
if [ "$PW_PULSE_INSTALLED" = true ]; then
    if [ "$FLATPAK_APPS" = true ]; then
        echo "VULNERABLE — pipewire-pulse is installed and Flatpak apps are present. No patch available."
        exit 0
    else
        echo "VULNERABLE — pipewire-pulse is installed (no Flatpak apps detected, but component is exposed). No patch available."
        exit 0
    fi
else
    echo "PATCHED — pipewire-pulse is not installed. System is not affected by CVE-2026-5674."
    exit 1
fi

Sources

1. CVE Record — CVE-2026-5674
2. Amazon Linux Security — CVE-2026-5674
3. Debian Package Tracker — pipewire
4. PipeWire Official Site
5. MITRE ATT&CK — DLL Search Order Hijacking (T1574.001)
6. Flatpak Sandbox Escape Advisory (GHSA-cc2q-qc34-jprg) — related context
7. CISA Weekly Vulnerability Summary