What’s Vulnerable › Vulnerabilities

CVE-2026-35094: Libinput: libinput: information disclosure via dangling pointer in lua plugin handling

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-01 · updated 2026-10-26
• Weakness: CWE-825

Description

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

Affected products

• Fedoraproject Fedora: 43, 44
• libinput: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-35094
• https://bugzilla.redhat.com/show_bug.cgi?id=2453840
• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272

Get alerted when CVE-2026-35094 or the next vulnerability affects your stack