CVE-2026-35093: fedoraproject fedora Code Injection
Vulnerability summary
CVE-2026-35093 is a high (CVSS 8.8) Code Injection vulnerability in fedoraproject fedora. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 01-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
+0.03 pp
From 0.18% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libinput< 1.31.1-1
Fedoraproject1 product
- fedora43 | 44
Freedesktop1 product
- libinput< 1.30.3 | ≥ 1.30.4, < 1.31.1
Ubuntu1 product
- libinputAll versions (No fix recorded)
4 vendors · 4 products
