PT-2026-1852 · Unknown · Inputplumber

Matthias Gerstner · Published 2025-11-21 · Updated 2026-01-14 · CVE-2025-66005

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions InputPlumber versions prior to 0.63.0

Description A missing authorization check in the InputManager D-Bus interface of InputPlumber can result in local Denial-of-Service, information disclosure, or potential privilege escalation within the context of the active user session.

Recommendations Update InputPlumber to version 0.63.0 or later.

Fix

DoS

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

BDU:2026-01039

CVE-2025-66005

Affected Products

Inputplumber

References · 12

• https://bdu.fstec.ru/vul/2026-01039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66005 · Security Note
• https://github.com/ShadowBlip/InputPlumber/releases/tag/v0.69.0 · Note
• https://security.opensuse.org/2026/01/09/inputplumber-lack-of-dbus-auth.html · Note
• https://twitter.com/andersonc0d3/status/2009697211052106081 · Twitter Post
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66005 · Note
• https://twitter.com/ThreatSynop/status/2010670586226184212 · Twitter Post
• https://twitter.com/oss_security/status/2009793794288263273 · Twitter Post
• https://anti-malware.ru/news/2026-01-08-111332/48632 · Note
• https://twitter.com/CVEnew/status/2011555227468697895 · Twitter Post
• https://seclists.org/oss-sec/2026/q1/46 · Note
• https://twitter.com/threatcluster/status/2010637995645305019 · Twitter Post