Is CVE-2026-50265 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50265 being exploited in the wild.

How severe is CVE-2026-50265?

High severity, with a CVSS score of 7, published 5 June 2026.

Which products and versions are affected?

Freedesktop.Org Libinput Up to and including 1.28.1-1.

Is there a fix for CVE-2026-50265?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50265 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-50265?

Check whether you run Freedesktop.Org Libinput at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50265: libinput privilege escalation via udev property injection in libinput-device-group

CVE-2026-50265 · Severity: high · CVSS 7 · Published 2026-06-05

A security vulnerability in libinput, a library used by Linux systems to handle input devices like keyboards and mice, could allow a local user to gain administrative (root) control of the system. By creating a specially crafted virtual input device, an attacker can trick the system's device manager into running unauthorized commands. This could lead to a complete system takeover, data theft, or permanent disruption of the computer's operations.

Technologies: Freedesktop.Org Libinput. Vendors: Freedesktop.Org.

Quick answers

Is CVE-2026-50265 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50265 being exploited in the wild.
How severe is CVE-2026-50265?: High severity, with a CVSS score of 7, published 5 June 2026.
Which products and versions are affected?: Freedesktop.Org Libinput Up to and including 1.28.1-1.
Is there a fix for CVE-2026-50265?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50265 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-50265?: Check whether you run Freedesktop.Org Libinput at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the libinput-device-group helper due to improper neutralization of control characters in the 'phys' string of input devices. When libinput-device-group is executed by udev via IMPORT{program}, it prints the LIBINPUT_DEVICE_GROUP property to stdout. An attacker with access to /dev/uinput can use UI_SET_PHYS to include newline characters followed by malicious udev properties (e.g., REMOVE_CMD). Because libinput fails to escape these newlines, udev interprets the injected lines as separate, valid properties. If an attacker injects a property like REMOVE_CMD, the system will execute the specified arbitrary command with root privileges when the virtual device is removed.

Affected products

freedesktop.org libinput Up to and including 1.28.1-1

Timeline

2026-05-27: other: Vulnerability observed in upstream main snapshot
2026-06-05: disclosed: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.