Hi,

The following vulnerability was published for pipewire.

Can you please check with upstream, at time of writing this bugreport
only the Red Hat bugzilla entry was available. So it is unclear if
this is known upstream, tracked upstream, fixed upstream or else.

CVE-2026-5674[0]:
| A flaw was found in PipeWire, a multimedia server. This
| vulnerability allows an attacker to escape sandboxed applications,
| such as Flatpak, by exploiting PipeWire's PulseAudio compatibility
| layer. An attacker with minimal permissions within a sandboxed
| environment can load a malicious library, leading to arbitrary code
| execution outside the sandbox and potential compromise of the user's
| system.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-5674
https://www.cve.org/CVERecord?id=CVE-2026-5674
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2455341

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hi,

By looking at the Red Hat package [1], CVE-2026-5674 seems to be fixed
by several commits:
- 6bc07dfe: only dlopen from the defined search paths
- 821b62da: dlopen: improve prefix check some more
- 8be0d753: dlopen: support search path ending in /
- 0b117921: filter-graph: error when there are no valid nodes
- aae60d8d: filter-graph: relax LADSPA plugin loading

All these commits landed in the branch 1.6 in April/May before the
release 1.6.6.
This is still to be confirmed, but I'd say CVE-2026-5674 is fixed since 1.6.6.

[1] https://gitlab.com/redhat/centos-stream/rpms/pipewire/-/commit/bebe5357bc8faee5dd22317b0e1ce624f7ce1a16

Best regards,
Dylan

Le dim. 19 juil. 2026 à 16:19, Salvatore Bonaccorso
<carnil@debian.org> a écrit :

Hi Dylan,

Looks it make sense. Are you able to reach out to upstream to make
sure this is the set needed, we would make sure we will correctly
track the isseu. But it maps now to what Red Hat has picked up for
their updates.

Regards,
Salvatore