Libinput
Monthly
Arbitrary root code execution in libinput before 1.30.4 and 1.31.x before 1.31.3 arises because the libinput-device-group helper emits the device 'phys' (physical path) property without escaping it. Since this output is consumed by udev - which runs as root - an attacker who controls a device's phys string can inject additional udev properties and have commands executed with root privileges. Publicly available exploit code exists (SSVC exploitation: PoC) but EPSS is very low (0.02%, 6th percentile) and it is not on CISA KEV, indicating no confirmed in-the-wild exploitation.
Local privilege escalation in libinput allows authenticated users to execute arbitrary code within graphical compositor contexts by placing malicious Lua bytecode in system or user configuration directories. The vulnerability achieves scope change (CVSS:S:C) with high impact across confidentiality, integrity, and availability (8.8 CVSS), enabling attackers to monitor keyboard input including passwords and sensitive data. No public exploit identified at time of analysis, with EPSS data unavailable for this recently disclosed vulnerability.
Libinput versions prior to 1.26.0 contain a dangling pointer vulnerability in Lua plugin garbage collection that allows local authenticated attackers to read sensitive data from system logs, requiring the ability to deploy malicious Lua plugin files to system directories and Lua plugin support to be enabled in the compositor. The vulnerability has a CVSS score of 3.3 (low severity) with confirmed patch availability, and poses minimal real-world risk due to high prerequisites including local file write access and plugin enablement.
A format string vulnerability was found in libinput. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arbitrary root code execution in libinput before 1.30.4 and 1.31.x before 1.31.3 arises because the libinput-device-group helper emits the device 'phys' (physical path) property without escaping it. Since this output is consumed by udev - which runs as root - an attacker who controls a device's phys string can inject additional udev properties and have commands executed with root privileges. Publicly available exploit code exists (SSVC exploitation: PoC) but EPSS is very low (0.02%, 6th percentile) and it is not on CISA KEV, indicating no confirmed in-the-wild exploitation.
Local privilege escalation in libinput allows authenticated users to execute arbitrary code within graphical compositor contexts by placing malicious Lua bytecode in system or user configuration directories. The vulnerability achieves scope change (CVSS:S:C) with high impact across confidentiality, integrity, and availability (8.8 CVSS), enabling attackers to monitor keyboard input including passwords and sensitive data. No public exploit identified at time of analysis, with EPSS data unavailable for this recently disclosed vulnerability.
Libinput versions prior to 1.26.0 contain a dangling pointer vulnerability in Lua plugin garbage collection that allows local authenticated attackers to read sensitive data from system logs, requiring the ability to deploy malicious Lua plugin files to system directories and Lua plugin support to be enabled in the compositor. The vulnerability has a CVSS score of 3.3 (low severity) with confirmed patch availability, and poses minimal real-world risk due to high prerequisites including local file write access and plugin enablement.
A format string vulnerability was found in libinput. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.