Skip to content
Verified reproduction

CVE-2026-5674: PipeWire sandbox escape via malicious library loading in PulseAudio compatibility layer

CVE-2026-5674 is verified against the affected target This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00309.

REPRO-2026-00309 Jul 28, 2026 CVE entry .txt
Severity HIGH
Confidence HIGH
Reproduced in 88m 8s
Tool calls 286
Spend $9.12
$ pruva-verify REPRO-2026-00309
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00309/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

CVE-2026-5674 is a Linux sandbox escape in PipeWire. Public advisories describe an attacker with minimal permissions inside a sandboxed environment, such as Flatpak, loading a malicious library through PipeWire's PulseAudio compatibility layer to escape the sandbox and execute code outside it.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.