CVE-2026-35094
âšī¸ lowSummary
A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
CVSS Score
3.3
Low
EPSS Score
0.0
Exploit Probability
Published Date
2026-04-01
First Seen: 2026-04-08
đ Relative Risk Intelligence
This CVE is Lower Risk - more severe than 2.8% of all 318,071 vulnerabilities in our database.
#309,119
Below average severity
Severity Percentile
đ¯ CISA SSVC Assessment Updated: Apr 1, 2026
đ Exploitation Status
None
No known exploits
âī¸ Automatable
NO
Requires human interaction
đĨ Technical Impact
Partial
Limited system impact
đ Discovered By
Red Hat would like to thank Koen Tange (monokles.eu) for reporting this issue.
SSVC data provided by
CISA
Last Modified
2026-04-07
Source
NVD đ
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE IDs (Weakness Types)