CVE-2026-35093

CVE-2026-35093 identifies a high-severity vulnerability in libinput, allowing a local attacker to achieve unauthorized code execution and information disclosure. By placing a specially crafted Lua bytecode file in specific configuration directories, an attacker can bypass security restrictions and execute arbitrary code with the permissions of programs using libinput, such as a graphical compositor. This vulnerability is rated 8.8 HIGH, featuring a local attack vector with low complexity and requiring low privileges, with no user interaction. Successful exploitation could lead to significant impacts, including monitoring keyboard input and exfiltrating sensitive data. Currently, there is no evidence of active exploitation, nor are public exploit modules available, though it has received some community discussion and limited media attention.