Skip to content
securitytabs

CVE-2026-5674

High8.8

Red Hat Enterprise Linux 10: Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loadingtitle from the CVE record

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

CVSS
8.8v3.1
EPSS (exploit probability)
0.2%8th pct
CISA KEV
Not listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS held steady from 0.2% on 2026-09-25 to 0.2% on 2026-10-26, ranging 0.2%–0.2% across 31 daily scores.
2026-09-25 → 2026-10-26 · 31 days · 0.2%–0.2%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-260.2%8.0%
2026-10-250.2%8.0%
2026-10-240.2%7.7%
2026-10-230.2%7.7%
2026-10-220.2%7.7%
2026-10-210.2%7.7%
2026-10-200.2%7.7%
2026-10-190.2%7.6%
2026-10-180.2%7.6%
2026-10-170.2%7.6%
2026-10-160.2%7.6%
2026-10-150.2%7.6%
2026-10-140.2%7.6%
2026-10-130.2%7.5%
2026-10-120.2%7.5%
2026-10-110.2%7.5%
2026-10-100.2%7.5%
2026-10-090.2%7.4%
2026-10-080.2%7.4%
2026-10-070.2%7.4%
2026-10-060.2%7.4%
2026-10-050.2%7.3%
2026-10-040.2%7.3%
2026-10-030.2%7.3%
2026-10-020.2%7.3%
2026-10-010.2%7.3%
2026-09-300.2%7.3%
2026-09-290.2%7.3%
2026-09-270.2%7.3%
2026-09-260.2%7.3%
2026-09-250.2%7.2%

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Learn

Why it happened and what stops it

The weakness (CWE)

Coverage1 article

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-27 05:11 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-27 05:11 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-27 05:11 UTC; score date 2026-10-26
  • KEV: CISA KEV, fetched 2026-10-27 05:11 UTC