Is CVE-2026-35093 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35093 being exploited in the wild.

How severe is CVE-2026-35093?

High severity, with a CVSS score of 8.8, published 1 April 2026.

Which products and versions are affected?

Freedesktop.Org Libinput up to (excluding) 1.30.3, and 1.30.4 up to (excluding) 1.31.1.

Is there a fix for CVE-2026-35093?

A patch was published on 2026-04-03: Fix identified in libinput 1.30.3 and 1.31.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35093 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-35093?

Check whether you run Freedesktop.Org Libinput at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35093: freedesktop libinput code injection via Lua bytecode plugins

CVE-2026-35093 · Severity: high · CVSS 8.8 · Published 2026-04-01

A security vulnerability has been identified in libinput, a library used by Linux operating systems to handle input devices like keyboards and mice. A local attacker could place a malicious file on the system to execute unauthorized code with high privileges, typically those of the graphical interface manager. This could allow an attacker to secretly monitor all keyboard activity, including passwords and sensitive data, and send it to an external location.

Technologies: Freedesktop.Org Libinput. Vendors: Freedesktop.Org.

Quick answers

Is CVE-2026-35093 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35093 being exploited in the wild.
How severe is CVE-2026-35093?: High severity, with a CVSS score of 8.8, published 1 April 2026.
Which products and versions are affected?: Freedesktop.Org Libinput up to (excluding) 1.30.3, and 1.30.4 up to (excluding) 1.31.1.
Is there a fix for CVE-2026-35093?: A patch was published on 2026-04-03: Fix identified in libinput 1.30.3 and 1.31.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35093 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-35093?: Check whether you run Freedesktop.Org Libinput at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in libinput due to the improper loading of Lua plugins. The library uses the 'luaL_loadfile' function, which defaults to 'bt' (binary and text) mode, allowing the execution of unverified Lua bytecode. A local attacker with the ability to write to system or user configuration directories (e.g., /etc/libinput/plugins or XDG_CONFIG_HOME/libinput/plugins) can deploy a crafted bytecode file to bypass sandboxing and execute code with the privileges of the calling process, such as a Wayland compositor. This is particularly impactful on systems where libinput is compiled with '-Dautoload-plugins'. The issue is addressed in libinput versions 1.30.3 and 1.31.1 by switching to 'luaL_loadfilex' with text-only ('t') mode.

Affected products

freedesktop libinput up to (excluding) 1.30.3, and 1.30.4 up to (excluding) 1.31.1
fedoraproject Fedora 43, 44
Red Hat Red Hat Enterprise Linux 7 affected

Timeline

2026-04-01: disclosed: Initial report and Bugzilla entry created
2026-04-01: advisory: NVD and Red Hat advisories published
2026-04-03: patched: Fix identified in libinput 1.30.3 and 1.31.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.