A flaw was found in PipeWire, a multimedia server
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.
CVSS Score
8.8
HIGH
Published
16 Jul 2026 14:16
Modified
06 Aug 2026 22:18
Source
CIRCL
CVSS v3 Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Local
Complexity
Low
Privileges
Low
Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Weaknesses (CWE)
CWE-427
Affected Systems
No vendor data available.
External Links
KEV Status
Not in CISA KEV catalog