CVE-2026-35093

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-35093	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2453839	Issue Tracking Third Party Advisory
https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1271	Broken Link
https://access.redhat.com/security/cve/CVE-2026-35093	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2453839	Issue Tracking Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35093.json

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:freedesktop:libinput::::::::
	cpe:2.3:a:freedesktop:libinput::::::::
	cpe:2.3:o:fedoraproject:fedora:43:::::::*
	cpe:2.3:o:fedoraproject:fedora:44:::::::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en libinput. Un atacante local que puede colocar un archivo de bytecode Lua especialmente diseñado en ciertos directorios de configuración del sistema o del usuario puede eludir las restricciones de seguridad. Esto permite al atacante ejecutar código no autorizado con los mismos permisos que el programa que utiliza libinput, como un compositor gráfico. Esto podría llevar a que el atacante monitoree la entrada del teclado y al envío de esa información a una ubicación externa.

Information

Published : 2026-04-01 14:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35093

Mitre link : CVE-2026-35093

CVE.ORG link : CVE-2026-35093

JSON object : View

Products Affected

freedesktop

libinput

fedoraproject

fedora

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-35093", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35093", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-03T13:46:32.320920Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-04-01T14:16:57.443", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-35093", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453839", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1271", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-35093", "tags": ["Third Party Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453839", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35093.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en libinput. Un atacante local que puede colocar un archivo de bytecode Lua especialmente dise\u00f1ado en ciertos directorios de configuraci\u00f3n del sistema o del usuario puede eludir las restricciones de seguridad. Esto permite al atacante ejecutar c\u00f3digo no autorizado con los mismos permisos que el programa que utiliza libinput, como un compositor gr\u00e1fico. Esto podr\u00eda llevar a que el atacante monitoree la entrada del teclado y al env\u00edo de esa informaci\u00f3n a una ubicaci\u00f3n externa."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freedesktop:libinput:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3829AD08-1AAF-42AA-8CA8-A9053797F35C", "versionEndExcluding": "1.30.3"}, {"criteria": "cpe:2.3:a:freedesktop:libinput:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A122E860-3D8E-4A07-9460-B636AA4BFC7A", "versionEndExcluding": "1.31.1", "versionStartIncluding": "1.30.4"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:43:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D1BBE5-0886-4D95-9862-16A4C316F70A"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:44:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD1E6B15-C7BF-47E1-8034-501385D7B7DD"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}