PT-2026-29524 · Libinput · Libinput

Koen Tange · Published 2026-04-01 · Updated 2026-04-09 · CVE-2026-35093

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libinput (affected versions not specified)

Description A flaw exists in libinput that allows a local attacker to bypass security restrictions by placing a specially crafted Lua bytecode file in specific system or user configuration directories. This can lead to the execution of unauthorized code with the same permissions as the program utilizing libinput, such as a graphical compositor. Successful exploitation could allow an attacker to monitor keyboard input and transmit it to an external location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-35093

OPENSUSE-SU-2026:10489-1

Affected Products

Libinput

References · 18

• https://cve.org/CVERecord?id=CVE-2026-35093 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35093 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35093 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10489-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35093 · Security Note
• https://t.me/msrcreports/3758 · Telegram Post
• https://twitter.com/CveFindCom/status/2039670079680287168 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-35093 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2453839 · Note
• https://twitter.com/CVEnew/status/2039372052696547725 · Twitter Post
• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1271 · Note
• https://twitter.com/TheHackerWire/status/2039354787855274491 · Twitter Post
• https://twitter.com/oss_security/status/2039565502121484607 · Twitter Post