CVE-2026-35094

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-35094	Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=2453840	Issue Tracking Third Party Advisory
https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:freedesktop:libinput:-:::::::*
	cpe:2.3:o:fedoraproject:fedora:43:::::::*
	cpe:2.3:o:fedoraproject:fedora:44:::::::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en libinput. Un atacante capaz de desplegar un archivo de plugin Lua en directorios específicos del sistema puede explotar una vulnerabilidad de puntero colgante. Esto ocurre cuando se llama a una función de limpieza de recolección de basura, dejando un puntero que luego puede ser impreso en los registros del sistema. Esto podría potencialmente exponer datos sensibles si la ubicación de memoria es reutilizada, lo que lleva a la revelación de información. Para que este exploit funcione, los plugins Lua deben estar habilitados en libinput y cargados por el compositor.

Information

Published : 2026-04-01 14:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35094

Mitre link : CVE-2026-35094

CVE.ORG link : CVE-2026-35094

JSON object : View

Products Affected

freedesktop

libinput

fedoraproject

fedora

CWE

CWE-825

Expired Pointer Dereference

{"id": "CVE-2026-35094", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35094", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T15:39:17.037193Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "libinput", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-01T14:16:57.637", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-35094", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453840", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272", "tags": ["Broken Link"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en libinput. Un atacante capaz de desplegar un archivo de plugin Lua en directorios espec\u00edficos del sistema puede explotar una vulnerabilidad de puntero colgante. Esto ocurre cuando se llama a una funci\u00f3n de limpieza de recolecci\u00f3n de basura, dejando un puntero que luego puede ser impreso en los registros del sistema. Esto podr\u00eda potencialmente exponer datos sensibles si la ubicaci\u00f3n de memoria es reutilizada, lo que lleva a la revelaci\u00f3n de informaci\u00f3n. Para que este exploit funcione, los plugins Lua deben estar habilitados en libinput y cargados por el compositor."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freedesktop:libinput:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1361BCB2-9424-4B4C-A7EC-2AA611F0EF0F"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:43:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D1BBE5-0886-4D95-9862-16A4C316F70A"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:44:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD1E6B15-C7BF-47E1-8034-501385D7B7DD"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}