PipeWire versions prior to 0.3.63-7.oe2403sp4 contain a vulnerability involving multiple unbounded alloca() calls in the PulseAudio protocol server. This flaw allows an attacker with limited permissions inside a sandboxed environment, such as Flatpak, to escape the sandbox by loading a malicious library via PipeWire's PulseAudio compatibility layer. Successful exploitation can lead to arbitrary code execution outside the sandbox and compromise of the user's system. A patch fixing this issue is available in version 0.3.63-7.oe2403sp4.