--- title: "Escaping Linux Sandboxes via PipeWire (CVE-2026-5674) · Embrace The Red" url: https://daily.dev/posts/escaping-linux-sandboxes-via-pipewire-cve-2026-5674-embrace-the-red-x9e0vsjk1 source_url: https://embracethered.com/blog/posts/2026/pipewire-flatpak-linux-sandbox-escape-cve-2026-5674 type: article source: "Embrace The Red" published: 2026-07-30T18:13:04.533Z updated: 2026-07-31T04:18:20.657Z tags: ["security", "linux"] reading_time: 6 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Escaping Linux Sandboxes via PipeWire (CVE-2026-5674) · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 6 min read · 1 upvotes · 0 comments ## Summary A detailed exploit writeup for CVE-2026-5674, a sandbox escape vulnerability in PipeWire's PulseAudio compatibility layer. The bug chain involves three issues: authentication cookies are read but never validated (any 256 bytes pass), module loading is enabled by default, and dlopen() accepts arbitrary paths with no validation. A Flatpak app with only --socket=pulseaudio and write access to /tmp can load a malicious .so into PipeWire (which runs outside the sandbox), achieving full user-context code execution. The vulnerability was discovered using Claude Code and Opus 4.6, confirmed on Fedora, Ubuntu 24.04, and Debian 13, and affects any sandbox tech that mounts the PulseAudio socket — including Docker. CVSS score is 8.8 (High). The fix restricts dlopen() to allowlisted LADSPA plugin directories. Red Hat has released a patch. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [A Skipped Cookie Check Let Flatpak Apps Escape PipeWire’s Sandbox Entirely](https://daily.dev/posts/a-skipped-cookie-check-let-flatpak-apps-escape-pipewire-s-sandbox-entirely-i32pfsskc) · Latest Hacking News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/escaping-linux-sandboxes-via-pipewire-cve-2026-5674-embrace-the-red-x9e0vsjk1)