ALPINE-CVE-2026-35094
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-35094
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-35094.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-35094
- Upstream
- CVE-2026-35094
- Published
- 2026-04-01T14:16:57Z
- Modified
- 2026-11-03T06:33:02Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
- References