A flaw in PipeWire's PulseAudio compatibility layer allows sandbox escape and arbitrary code execution by loading malicious libraries from within sandboxed applications like Flatpak. The vulnerability requires only low privileges and no user interaction, but it changes the security scope, impacting confidentiality, integrity, and availability. Red Hat Enterprise Linux 10 versions before 10.2 are affected. The vendor has released an official security update (pipewire-1.4.11-1.el10_2) that mitigates this issue by disabling module loading or restricting library loading paths.

An attacker with minimal permissions inside a sandboxed environment can exploit this vulnerability to execute arbitrary code outside the sandbox, potentially compromising the user's system. This affects confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS score of 8.8, reflecting its severity and impact.

Red Hat has released an official security update that fixes this vulnerability. Users should apply the update to PipeWire packages to remediate the issue. Additionally, mitigation can be achieved by restricting containerized applications from accessing the PulseAudio socket or host-visible paths, configuring PipeWire to disable module loading by setting 'pulse.allow-module-loading = false', or restricting 'dlopen()' paths to trusted system directories. Restarting the PipeWire service is required for changes to take effect, which may impact audio functionality.