Libinput vulnerabilities

2 known vulnerabilities in Libinput from Freedesktop. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  libinput: Improper Neutralization of CRLF Sequences

  CVE-2026-50292Jun 4, 2026Freedesktop

  In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

• 8.8 High severity

  Red Hat Enterprise Linux 10: Improper Control of Generation of Code

  CVE-2026-35093Apr 1, 2026Red Hat

  A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions