Libinput CVE-2026-35094

The real-world risk is low despite information disclosure potential. CVSS vector AV:L/AC:L/PR:L indicates local access with low attack complexity but requires local authentication privilege, substantially limiting attacker pool. EPSS score not provided in input, but the vulnerability's reliance on: (1) local filesystem write access to deploy Lua plugin files, (2) administrative or privileged local user context, (3) compositor with Lua plugin support explicitly enabled, and (4) repeated garbage collection cycles to leak data, creates multiple barriers. No KEV (CISA Known Exploited Vulnerabilities) status provided, no public exploit code identified, and the information disclosed is limited to whatever happens to occupy the freed memory location-not credentials or keys directly. This is a privilege escalation + information disclosure combination requiring substantial preconditions, making it a low practical priority unless Lua plugins are explicitly used in the target deployment.

A local authenticated user with write access to system plugin directories (or via privilege escalation within a user session) deploys a specially crafted Lua plugin file to a libinput plugin search path. When the compositor loads plugins at startup or runtime, the malicious plugin is instantiated. The plugin code triggers specific Lua operations that cause garbage collection cleanup functions to execute, leaving dangling pointers. On subsequent garbage collection cycles or compositor operations, the dangling pointer is dereferenced and its contents (potentially from previously freed heap memory containing session data, environment variables, or cached tokens) are written to system logs readable by the attacker or other local users. No public proof-of-concept exploit is identified, but the attack requires no network access and only standard local user privileges.