Hi, By looking at the Red Hat package [1], CVE-2026-5674 seems to be fixed by several commits: - 6bc07dfe: only dlopen from the defined search paths - 821b62da: dlopen: improve prefix check some more - 8be0d753: dlopen: support search path ending in / - 0b117921: filter-graph: error when there are no valid nodes - aae60d8d: filter-graph: relax LADSPA plugin loading
All these commits landed in the branch 1.6 in April/May before the release 1.6.6. This is still to be confirmed, but I'd say CVE-2026-5674 is fixed since 1.6.6. [1] https://gitlab.com/redhat/centos-stream/rpms/pipewire/-/commit/bebe5357bc8faee5dd22317b0e1ce624f7ce1a16 Best regards, Dylan Le dim. 19 juil. 2026 à 16:19, Salvatore Bonaccorso <[email protected]> a écrit : > > Source: pipewire > Version: 1.6.8-1 > Severity: important > Tags: security upstream > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerability was published for pipewire. > > Can you please check with upstream, at time of writing this bugreport > only the Red Hat bugzilla entry was available. So it is unclear if > this is known upstream, tracked upstream, fixed upstream or else. > > CVE-2026-5674[0]: > | A flaw was found in PipeWire, a multimedia server. This > | vulnerability allows an attacker to escape sandboxed applications, > | such as Flatpak, by exploiting PipeWire's PulseAudio compatibility > | layer. An attacker with minimal permissions within a sandboxed > | environment can load a malicious library, leading to arbitrary code > | execution outside the sandbox and potential compromise of the user's > | system. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2026-5674 > https://www.cve.org/CVERecord?id=CVE-2026-5674 > [1] https://bugzilla.redhat.com/show_bug.cgi?id=2455341 > > Please adjust the affected versions in the BTS as needed. > > Regards, > Salvatore
