CVE-2026-5674Disclosure

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

Back to dashboard

2.3/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-427

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
11 mentions across 9 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 9 signals
Disclosure: 6 classified signals
General: 2 classified signals
Peaked 8d ago at 2 mentions (2026-07-16); latest day: 1
11 total mentions across 9 days

Deep dive

Activity timeline11 mentions / 9d

Signal classification4 categories

Disclosure

654.5%

General

218.2%

Patch

218.2%

PoC

19.1%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Disclosure1General1
2026-07-20	1	Patch1
2026-07-23	1	Disclosure1
2026-07-28	1	PoC1
2026-07-30	1	Disclosure1
2026-08-01	1	Disclosure1
2026-08-02	2	Disclosure1General1
2026-08-03	1	Patch1
2026-08-12	1	Disclosure1

Full discourse11 posts

Johann Rehberger@wunderwuzzi2377d
Disclosure
Wrote up a blog for the PipeWire sandbox escape via malicious library loading CVE-2026-5674 Details ⬇️ https://embracethered.com/blog/posts/2026/pipewire-flatpak-linux-sandbox-escape-cve-2026-5674/
Post summary
A blog post has been published describing a sandbox escape in PipeWire caused by malicious library loading (CVE‑2026‑5674). The post references detailed findings without offering PoC, exploit code, patches, or evidence of active exploitation.
3251110387.1K
11.3K followersView on X
Johann Rehberger@wunderwuzzi2384d
Disclosure
Linux sandbox escape 🙌 😈 CVE-2026-5674 Earlier this year, with the help of AI, I found a Linux sandbox escape by exploiting PipeWire. Technical write-up to follow... 👨‍💻 https://t.co/YqyObizOaP
Post summary
The author publicly announces the discovery of CVE‑2026‑5674, a Linux sandbox escape via PipeWire, and indicates a technical write‑up will follow.
030132176.5K
10.6K followersView on X
Clandestine@akaclandestine76d
Disclosure
Escaping Linux Sandboxes via PipeWire (CVE-2026-5674) · Embrace The Red https://embracethered.com/blog/posts/2026/pipewire-flatpak-linux-sandbox-escape-cve-2026-5674/
Post summary
The title and link indicate a new vulnerability (CVE-2026-5674) involving a Linux sandbox escape through PipeWire, but no further details or proof of exploitation are provided.
0401183.4K
64.8K followersView on X
Giuseppe `N3mes1s`@N3mes1s80d
PoC
CVE-2026-5674: PipeWire sandbox escape via malicious library loading in PulseAudio compatibility layer #pruva PulseAudio unix socket pulse-server.c do_load_module() module-ladspa-sink filter-chain LADSPA loader dlopen(<absolute path>) in the out-of-sandbox pipewire-pulse daemon https://pruva.dev/reproductions/REPRO-2026-00309
Post summary
A proof‑of‑concept demonstrating a PipeWire sandbox escape via malicious library loading in PulseAudio is shared, with specific technical details but no exploitation tools or active use reported.
11072700
13.5K followersView on X
kokumօtօ@__kokumoto74d
Patch
LinuxのPipeWireに、Flatpakアプリのサンドボックスエスケープに使用可能な脆弱性。CVE-2026-5674はCVSSスコア8.8で、PluseAudio互換レイヤーにおける不具合3件を連鎖させるもの。Pipewire 1.0.5で修正されており、各ディストロで順次修正。 https://latesthackingnews.com/2026/08/02/pipewire-sandbox-escape-cve-2026-5674/
Post summary
CVE-2026-5674 is a PipeWire sandbox escape vulnerability affecting Flatpak apps, with a CVSS score of 8.8 and fixed in PipeWire 1.0.5, with ongoing distribution updates.
00011782
7.6K followersView on X
Upwind Security MDR@UpwindMDR92d
Disclosure
🚨High - PipeWire Sandbox Escape via PulseAudio Compatibility Layer (CVE-2026-5674) PipeWire, the multimedia server default on most modern Linux distributions, contains an uncontrolled library search path in its PulseAudio compatibility layer. A process running inside a sandboxed app such as a Flatpak, with only minimal permissions, can load an attacker-controlled library. Loading that library results in arbitrary code execution outside the sandbox, breaking the confinement that Flatpak and similar sandboxes are meant to provide and potentially compromising the user's system. The vector is local with low privileges and scope change. CVSS 8.8. 👉Affected: pipewire on RHEL 9 and RHEL 10.
Post summary
CVE-2026-5674 exposes a pipewire sandbox escape via an uncontrolled library search path in the PulseAudio compatibility layer, enabling arbitrary local code execution and breaking confinement of Flatpak and similar sandboxes.
00010112
254 followersView on X
VulDB 🛡@vuldb92d
General
We have just added an important vulnerability affecting Red Hat PipeWire (CVE-2026-5674) https://vuldb.com/vuln/379530
Post summary
The post simply announces a new CVE for Red Hat PipeWire with a link to a vulnerability page, without further technical or mitigation details.
00010119
2.3K followersView on X
@pedri77@pedri7765d
Disclosure
CVE-2026-5674 chains a broken PulseAudio auth check, default module loading, and an unrestricted dlopen() into a full PipeWire sandbox escape from inside Flatpak apps like Discord. A Skipped Cookie Check Let Flatpak App... https://f.mtr.cool/wkakxklqnb
Post summary
The text reports CVE-2026-5674, outlining how a broken PulseAudio authentication check, default module loading, and unrestricted dlopen() can allow a full PipeWire sandbox escape from Flatpak apps like Discord, with no mention of patches or active exploitation.
0000080
2.1K followersView on X
sea-are-pea@seaarepea74d
General
Linux users starting to enjoy the joys of being an OS that people use" cve-2026-5674 A Skipped Cookie Check Let Flatpak Apps Escape PipeWire's Sandbox Entirely https://latesthackingnews.com/2026/08/02/pipewire-sandbox-escape-cve-2026-5674/ #ITSecurity
Post summary
The text introduces CVE-2026-5674 as a vulnerability involving a skipped cookie check that lets Flatpak apps escape PipeWire's sandbox. No exploit, patch, or evidence of active exploitation is provided.
0000042
75 followersView on X
Shah Sheikh@shah_sheikh75d
Disclosure
A Skipped Cookie Check Let Flatpak Apps Escape PipeWire’s Sandbox Entirely: CVE-2026-5674 chains a broken PulseAudio auth check, default module loading, and an unrestricted dlopen() into a full PipeWire sandbox escape from inside Flatpak apps like… https://latesthackingnews.com/2026/08/02/pipewire-sandbox-escape-cve-2026-5674/?utm_source=dlvr.it&utm_medium=twitter https://t.co/1kw8Jgj8Og
Post summary
The tweet announces the discovery of CVE‑2026‑5674, outlining how a chain of PulseAudio auth check bypass, default module loading, and unrestricted dlopen() can allow Flatpak applications to escape the PipeWire sandbox. No PoC, exploit tool, or patch information is included.
0000067
2.3K followersView on X
VulniPulse@vulnipulse88d
Patch
⚠️ Red Hat Enterprise Linux 10 alert: CVE-2026-5674 (CVSS 8.8) Attackers could execute arbitrary code. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/linux-cve-2026-5674 #Linux #RedHatEnterpriseLinux10 #RCE #CyberSecurity #CVE
Post summary
Red Hat has issued an alert for CVE‑2026‑5674, a CVSS 8.8 vulnerability that allows arbitrary code execution, and recommends applying vendor‑specified mitigation.
0000033
6 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-5674

Johann Rehberger[verified]@wunderwuzzi23Disclosure

A blog post has been published describing a sandbox escape in PipeWire caused by malicious library loading (CVE‑2026‑5674). The post references detailed findings without offering PoC, exploit code, patches, or evidence of active exploitation.

Johann Rehberger[verified]@wunderwuzzi23Disclosure

The author publicly announces the discovery of CVE‑2026‑5674, a Linux sandbox escape via PipeWire, and indicates a technical write‑up will follow.

Clandestine[verified]@akaclandestineDisclosure

The title and link indicate a new vulnerability (CVE-2026-5674) involving a Linux sandbox escape through PipeWire, but no further details or proof of exploitation are provided.

Giuseppe `N3mes1s`[verified]@N3mes1sPoC

A proof‑of‑concept demonstrating a PipeWire sandbox escape via malicious library loading in PulseAudio is shared, with specific technical details but no exploitation tools or active use reported.

kokumօtօ[verified]@__kokumotoPatch

CVE-2026-5674 is a PipeWire sandbox escape vulnerability affecting Flatpak apps, with a CVSS score of 8.8 and fixed in PipeWire 1.0.5, with ongoing distribution updates.

Upwind Security MDR[verified]@UpwindMDRDisclosure

CVE-2026-5674 exposes a pipewire sandbox escape via an uncontrolled library search path in the PulseAudio compatibility layer, enabling arbitrary local code execution and breaking confinement of Flatpak and similar sandboxes.

sea-are-pea[verified]@seaarepeaGeneral

The text introduces CVE-2026-5674 as a vulnerability involving a skipped cookie check that lets Flatpak apps escape PipeWire's sandbox. No exploit, patch, or evidence of active exploitation is provided.

Shah Sheikh[verified]@shah_sheikhDisclosure

The tweet announces the discovery of CVE‑2026‑5674, outlining how a chain of PulseAudio auth check bypass, default module loading, and unrestricted dlopen() can allow Flatpak applications to escape the PipeWire sandbox. No PoC, exploit tool, or patch information is included.