Log in Start free

Vulnerability · Published Apr 1, 2026 · Assigned by redhat

CVE-2026-35093Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins

High 8.8

In plain English

A high-severity code injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23libinput1.30.3-r0ALPINE-CVE-2026-35093
Debian:14libinput1.31.1-1DEBIAN-CVE-2026-35093
Ubuntu:26.04:LTSlibinputno fix listedUBUNTU-CVE-2026-35093

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References