# CVE-2026-50265: libinput privilege escalation via udev property injection in libinput-device-group

Source: https://junglewise.ai/threats/cve-2026-50265-libinput-privilege-escalation-via-udev-property-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-50265 · Severity: high · CVSS 7 · Published 2026-06-05

A security vulnerability in libinput, a library used by Linux systems to handle input devices like keyboards and mice, could allow a local user to gain administrative (root) control of the system. By creating a specially crafted virtual input device, an attacker can trick the system's device manager into running unauthorized commands. This could lead to a complete system takeover, data theft, or permanent disruption of the computer's operations.

Technologies: [Freedesktop.Org Libinput](https://junglewise.ai/threats/technologies/libinput). Vendors: [Freedesktop.Org](https://junglewise.ai/threats/vendors/freedesktop-org).

## Quick answers

**Is CVE-2026-50265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50265 being exploited in the wild.

**How severe is CVE-2026-50265?** High severity, with a CVSS score of 7, published 5 June 2026.

**Which products and versions are affected?** Freedesktop.Org Libinput Up to and including 1.28.1-1.

**Is there a fix for CVE-2026-50265?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50265 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-50265?** Check whether you run Freedesktop.Org Libinput at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the libinput-device-group helper due to improper neutralization of control characters in the 'phys' string of input devices. When libinput-device-group is executed by udev via IMPORT{program}, it prints the LIBINPUT_DEVICE_GROUP property to stdout. An attacker with access to /dev/uinput can use UI_SET_PHYS to include newline characters followed by malicious udev properties (e.g., REMOVE_CMD). Because libinput fails to escape these newlines, udev interprets the injected lines as separate, valid properties. If an attacker injects a property like REMOVE_CMD, the system will execute the specified arbitrary command with root privileges when the virtual device is removed.

## Affected products

- freedesktop.org libinput Up to and including 1.28.1-1

## Timeline

- 2026-05-27: other: Vulnerability observed in upstream main snapshot
- 2026-06-05: disclosed: Public disclosure and CVE assignment

## References

- [https://access.redhat.com/security/cve/CVE-2026-50265](https://access.redhat.com/security/cve/CVE-2026-50265)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2485390](https://bugzilla.redhat.com/show_bug.cgi?id=2485390)
- [https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296](https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296)

## Related threats

- [freedesktop.org libinput CRLF injection in libinput-device-group](https://junglewise.ai/threats/cve-2026-50292-freedesktop-org-libinput-crlf-injection-in-libinput-device-group)
- [freedesktop libinput code injection via Lua bytecode plugins](https://junglewise.ai/threats/cve-2026-35093-freedesktop-libinput-code-injection-via-lua-bytecode-plugins)