Is CVE-2026-5674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5674 being exploited in the wild.

How severe is CVE-2026-5674?

High severity, with a CVSS score of 8.8, published 16 July 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 9 affected.

Is there a fix for CVE-2026-5674?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5674 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-5674?

Check whether you run Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5674: PipeWire sandbox escape via PulseAudio compatibility layer

CVE-2026-5674 · Severity: high · CVSS 8.8 · Published 2026-07-16

PipeWire is a multimedia server used in Linux operating systems to manage audio and video streams. A security flaw in its PulseAudio compatibility layer allows a malicious application to break out of its restricted 'sandbox' (such as Flatpak) and execute code on the host system. This could allow an attacker to bypass security boundaries, access private user data, and take full control of the user's session.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-5674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5674 being exploited in the wild.
How severe is CVE-2026-5674?: High severity, with a CVSS score of 8.8, published 16 July 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 9 affected.
Is there a fix for CVE-2026-5674?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5674 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-5674?: Check whether you run Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-427 (Uncontrolled Search Path Element) exists in PipeWire's PulseAudio compatibility layer, specifically within 'module-protocol-pulse' and 'module-ladspa-sink'. An attacker within a sandboxed environment (e.g., Flatpak) with access to the PulseAudio socket and a writable host-visible directory can load a malicious shared library (.so) via the PA_COMMAND_LOAD_MODULE command. Because PipeWire executes outside the sandbox and calls dlopen() on the provided path without sufficient path validation, the library's constructor executes in the full context of the user session. Mitigations include setting 'pulse.allow-module-loading = false' or restricting dlopen() paths to trusted system directories.

Affected products

PipeWire Project PipeWire <= 1.0.5
Red Hat Red Hat Enterprise Linux 9 affected
Red Hat Red Hat Enterprise Linux 10 affected

Timeline

2026-04-06: other: Initial report in Red Hat Bugzilla
2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.