Escaping Linux Sandboxes via PipeWire (CVE-2026-5674)

A sandbox escape vulnerability (CVE-2026-5674) in PipeWire, the default audio server on modern Linux desktops, allows a sandboxed application to break out and gain full access to a user's files, desktop, and credentials. The attack exploits three flaws: PipeWire doesn't validate authentication cookies (it accepts any 256 bytes of garbage), module loading is enabled by default, and the module-ladspa-sink component doesn't check the path of libraries before loading them with dlopen() (a function that loads code from files). This means a sandboxed app with audio permissions can write malicious code to a shared folder like /tmp and trick PipeWire into running it outside the sandbox.