CVE-2026-50292

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50292
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50292.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50292
Downstream
Related
Published
2026-06-04T16:41:36.354Z
Modified
2026-07-08T08:13:41.629414235Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50292.json",
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-93"
    ]
}
References

Affected packages

Git / gitlab.freedesktop.org/libinput/libinput

Affected ranges

Type
GIT
Repo
https://gitlab.freedesktop.org/libinput/libinput
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ad8b37ffcc71aceb8eb4d079d22490e87168f49
Introduced
659967488e1e66d7fb7210c6b86860c8e1e5bed4
Fixed
26191d396d74d505541d6311f0b4ae68d791b890
Fixed
76f0d8a7f57e2868882864b4611281f12f704b55
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:freedesktop:libinput:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.30.4"
        },
        {
            "introduced": "1.31.0"
        },
        {
            "fixed": "1.31.3"
        }
    ]
}

Affected versions

0.*
0.1.0
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.2.0
0.20.0
0.21.0
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0
0.9.0
0.99.1
1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.901
1.1.902
1.10.0
1.10.901
1.10.902
1.11.0
1.11.901
1.11.902
1.11.903
1.12.0
1.12.1
1.12.2
1.12.3
1.12.901
1.12.902
1.13.0
1.13.901
1.13.902
1.14.0
1.14.1
1.14.901
1.15.0
1.15.1
1.15.2
1.15.3
1.15.901
1.15.902
1.16.0
1.16.1
1.16.901
1.16.902
1.17.0
1.17.901
1.18.0
1.18.901
1.19.0
1.19.1
1.19.2
1.19.901
1.2.0
1.2.1
1.2.2
1.2.901
1.2.902
1.2.903
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.26.1
1.26.2
1.27.0
1.27.1
1.28.0
1.28.1
1.28.901
1.28.902
1.28.903
1.29.0
1.29.901
1.29.902
1.3.0
1.3.901
1.30.0
1.30.1
1.30.2
1.30.3
1.31.0
1.31.1
1.31.2
1.4.0
1.4.901
1.5.0
1.5.1
1.5.2
1.5.901
1.5.902
1.6.0
1.6.901
1.6.902
1.7.0
1.7.901
1.7.902
1.8.0
1.8.901
1.8.902
1.9.0
1.9.1
1.9.901
1.9.902

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50292.json"