Homepage

Uncontrolled Search Path Element The advisory has been revoked - it doesn't affect any version of package pipewire  (opens in a new tab)

Threat Intelligence

EPSS
0.19% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PIPEWIRE-17997417
  • published17 Jul 2026
  • disclosed4 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 4 Jul 2026

CVE-2026-5674  (opens in a new tab)
CWE-427  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pipewire package and not the pipewire package as distributed by RHEL.

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.