UBUNTU-CVE-2026-35093

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-35093

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35093.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-35093

Upstream

CVE-2026-35093

Withdrawn

2026-06-05T21:54:40Z

Published

2026-04-01T14:16:00Z

Modified

2026-06-05T23:45:15Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

References

Affected packages

Ubuntu:26.04:LTS / libinput

Package

Name: libinput
Purl: pkg:deb/ubuntu/libinput?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.28.1-1build1

1.28.1-1ubuntu2

1.30.0-1

1.30.1-1

1.31.0-1

1.31.0-1ubuntu0.1

1.31.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libinput-bin",
            "binary_version": "1.31.1-1"
        },
        {
            "binary_name": "libinput-tools",
            "binary_version": "1.31.1-1"
        },
        {
            "binary_name": "libinput10",
            "binary_version": "1.31.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35093.json"