CVE-2026-35094

ℹ️ low

Summary

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

CVSS Score

3.3

Low

EPSS Score

0.0

Exploit Probability

Published Date

2026-04-01

First Seen: 2026-04-08

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 2.8% of all 350,976 vulnerabilities in our database.

#341,293

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 1, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Red Hat would like to thank Koen Tange (monokles.eu) for reporting this issue.

SSVC data provided by CISA

Last Modified 2026-04-07

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE IDs (Weakness Types)

CWE-825

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
fedoraproject	fedora	Affected	v43
fedoraproject	fedora	Affected	v44
freedesktop	libinput	Affected	v-

🔗 References 3

https://access.redhat.com/security/cve/CVE-2026-35094

VDB Entry Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2453840

Issue Tracking Third Party Advisory

https://gitlab.freedesktop.org/libinput/libinput/-/w...

Broken Link

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-54230	⚠️ high	7.0	0.2	A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts wr...	2026-06-13
CVE-2026-54231	🔶 medium	5.5	0.2	A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script...	2026-06-13
CVE-2026-50292	⚠️ high	7.4	0.3	In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properti...	2026-06-04
CVE-2026-35093	⚠️ high	8.8	0.2	A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or ...	2026-04-01
CVE-2023-4134	🔶 medium	5.5	0.0	A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device...	2024-11-14
CVE-2024-3056	⚠️ high	7.7	0.4	A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configur...	2024-08-02

These CVEs affect the same products