PT-2026-1852 · Unknown · Inputplumber

Matthias Gerstner · Publicado 2025-11-21 · Atualizado 2026-01-14 · CVE-2025-66005

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions InputPlumber versions prior to 0.63.0

Description A missing authorization check in the InputManager D-Bus interface of InputPlumber can result in local Denial-of-Service, information disclosure, or potential privilege escalation within the context of the active user session.

Recommendations Update InputPlumber to version 0.63.0 or later.

Correção

DoS

Incorrect Authorization

Improper Authentication

Enumeração de Fraquezas

CWE-863

CWE-287

Identificadores relacionados

BDU:2026-01039

CVE-2025-66005

Produtos afetados

Inputplumber

Referências · 12

• https://github.com/ShadowBlip/InputPlumber/releases/tag/v0.69.0 · Nota
• https://security.opensuse.org/2026/01/09/inputplumber-lack-of-dbus-auth.html · Nota
• https://twitter.com/andersonc0d3/status/2009697211052106081 · Publicação no Twitter
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66005 · Nota
• https://twitter.com/ThreatSynop/status/2010670586226184212 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-01039 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-66005 · Nota de Segurança
• https://twitter.com/oss_security/status/2009793794288263273 · Publicação no Twitter
• https://anti-malware.ru/news/2026-01-08-111332/48632 · Nota
• https://twitter.com/CVEnew/status/2011555227468697895 · Publicação no Twitter
• https://seclists.org/oss-sec/2026/q1/46 · Nota
• https://twitter.com/threatcluster/status/2010637995645305019 · Publicação no Twitter