Home

Description

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

PUBLISHED Reserved 2026-04-01 | Published 2026-04-01 | Updated 2026-04-03 | Assigner redhat




HIGH: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Problem types

Improper Control of Generation of Code ('Code Injection')

Product status

Default status
unaffected

Default status
unknown

Default status
unaffected

Default status
unaffected

Timeline

2026-04-01:Reported to Red Hat.
2026-04-01:Made public.

Credits

Red Hat would like to thank Koen Tange (monokles.eu) for reporting this issue.

References

access.redhat.com/security/cve/CVE-2026-35093 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2453839 (RHBZ#2453839) issue-tracking

gitlab.freedesktop.org/libinput/libinput/-/work_items/1271

cve.org (CVE-2026-35093)

nvd.nist.gov (CVE-2026-35093)

Download JSON