A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade pipewire-module-x11Upgrade pipewire-alsa-debuginfoUpgrade pipewire-libsUpgrade pipewire-config-ratesUpgrade pipewire-plugin-vulkanUpgrade pipewire-jack-audio-connection-kit-develUpgrade pipewire-plugin-vulkan-debuginfoUpgrade pipewire-utils-debuginfoUpgrade pipewire-jack-audio-connection-kitUpgrade pipewire-v4l2-debuginfoUpgrade pipewire-v4l2Upgrade pipewire-jack-audio-connection-kit-libsUpgrade pipewire-develUpgrade pipewire-docUpgrade pipewire-debuginfoUpgrade pipewire-utilsUpgrade pipewire-module-x11-debuginfoUpgrade pipewire-alsaUpgrade pipewire-jack-audio-connection-kit-libs-debuginfoUpgrade pipewire-pulseaudio-debuginfoUpgrade pipewire-config-upmixUpgrade pipewire-debugsourceUpgrade pipewire-libs-debuginfoUpgrade pipewire-pulseaudioUpgrade pipewire-gstreamerUpgrade pipewire-gstreamer-debuginfoUpgrade pipewire | Aug 10, 2026 | Jul 16, 2026 |
| Redhat_linux | — | Upgrade pipewire-module-x11Upgrade pipewire-jack-audio-connection-kit-develUpgrade pipewire-pulseaudioUpgrade pipewire-gstreamerUpgrade pipewire-gstreamer-debuginfoUpgrade pipewire-pulseaudio-debuginfoUpgrade pipewire-debugsourceUpgrade pipewire-alsa-debuginfoUpgrade pipewire-utilsUpgrade pipewire-jack-audio-connection-kit-libsUpgrade pipewire-module-x11-debuginfoUpgrade pipewire-plugin-libcameraUpgrade pipewire-alsaUpgrade pipewire-libs-debuginfoUpgrade pipewire-jack-audio-connection-kit-libs-debuginfoUpgrade pipewire-libsUpgrade pipewire-v4l2-debuginfoUpgrade pipewireUpgrade pipewire-develUpgrade pipewire-plugin-vulkan-debuginfoUpgrade pipewire-jack-audio-connection-kitUpgrade pipewire-jack-audio-connection-kit-debuginfoUpgrade pipewire-utils-debuginfoUpgrade pipewire-plugin-libcamera-debuginfoUpgrade pipewire-debuginfo | Jul 20, 2026 | Jul 4, 2026 |
| Rocky_linux | — | Upgrade pipewire-debugsourceUpgrade pipewire-alsa-debuginfoUpgrade pipewire-jack-audio-connection-kitUpgrade pipewire-jack-audio-connection-kit-libs-debuginfoUpgrade pipewire-utilsUpgrade pipewire-gstreamer-debuginfoUpgrade pipewire-libs-debuginfoUpgrade pipewire-libsUpgrade pipewire-pulseaudioUpgrade pipewire-utils-debuginfoUpgrade pipewireUpgrade pipewire-module-x11Upgrade pipewire-develUpgrade pipewire-jack-audio-connection-kit-develUpgrade pipewire-pulseaudio-debuginfoUpgrade pipewire-gstreamerUpgrade pipewire-module-x11-debuginfoUpgrade pipewire-alsaUpgrade pipewire-debuginfoUpgrade pipewire-jack-audio-connection-kit-libs | Jul 31, 2026 | Jul 29, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub