CVE-2026-35093
High
Description
A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.
SeverityHigh
CVSS8.8
Exploit probability8. percentile0.2%
Product
Freedesktop Libinput
PublishedApr 1, 2026
First seenApr 1, 2026
Weakness typeCWE-94Code injection
How to fix
Update
- freedesktop libinput1.30.3, 1.31.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freedesktop libinput | v < 1.30.3, 1.30.4 ≤ v < 1.31.1 | 1.30.3, 1.31.1 |
| fedoraproject fedora | 43, 44 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.