ZeroDay Findings
Sign inSign up

Findings

CVE-2026-35093

A flaw was found in libinput.

Published Apr 1, 2026 · updated Jul 15, 2026 · freedesktop libinput

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 1, 2026 · NIST NVD

    Detected

    A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that i

  2. Jul 15, 2026 · NIST NVD

    Updated

    A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that i

Affected

  • cpe fedoraproject/fedora43
  • cpe fedoraproject/fedora44
  • cpe freedesktop/libinputversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-35093

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-35093

    A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program usin

    nvd.nist.gov

References