A flaw was found in PipeWire, a multimedia server. The vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire’s PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user’s system. The weakness corresponds to CWE‑427, an external control of file name or path. The primary impact is the ability to run arbitrary code in the host environment, which could allow a local user or a compromised container to take full control of the system.

The affected products are Red Hat Enterprise Linux releases 7, 8, 9, and 10. Any system running these versions with the default PipeWire configuration is vulnerable. The CVE lists no specific sub‑products or service packs, implying that all standard RHEL image variants in the listed releases are impacted.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score is < 1%, and the lack of KEV listing suggests that no publicly known exploitation campaigns have been documented yet. However, the attack vector is inferred to be local, requiring the attacker to run code within a sandboxed application or have control over a Flatpak container. Once the malicious library is loaded, the attacker achieves code execution in the host context, bypassing sandbox confinement. This high impact and relatively low exploitation barrier make the vulnerability a significant risk.