OESA-2026-4633: pipewire security update

Q: What level of access does an attacker need to exploit the sandbox-escape issue?

The issue requires minimal permissions within a sandboxed application environment, such as Flatpak. The reported attack path involves loading a malicious library through PipeWire's PulseAudio compatibility layer.

Q: Is this vulnerability exposed remotely?

The severity vector lists local attack vector access. The available information describes exploitation from within a sandboxed local application environment rather than a network-based attack.

Published Oct 29, 2026

Updated

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fix(es):

Multiple unbounded alloca() calls in the PulseAudio protocol server.(CVE-2026-14330)

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.(CVE-2026-5674)

Affected Software

1 affected componentFixes available

openeuler/pipewire<0.3.63-7.oe2403sp4

0.3.63-7.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/pipewire to a version that resolves this vulnerability.
Fixed in 0.3.63-7.oe2403sp4

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What level of access does an attacker need to exploit the sandbox-escape issue?

The issue requires minimal permissions within a sandboxed application environment, such as Flatpak. The reported attack path involves loading a malicious library through PipeWire's PulseAudio compatibility layer.

Is this vulnerability exposed remotely?

The severity vector lists local attack vector access. The available information describes exploitation from within a sandboxed local application environment rather than a network-based attack.

OESA-2026-4633: pipewire security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need to exploit the sandbox-escape issue?

Is this vulnerability exposed remotely?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit the sandbox-escape issue?

Is this vulnerability exposed remotely?