CVE-2026-35093

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.

• CWE-94
• CWE-94

• https://access.redhat.com/security/cve/CVE-2026-35093Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2453839Issue Tracking, Third Party Advisory
• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1271Broken Link
• https://access.redhat.com/security/cve/CVE-2026-35093Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2453839Issue Tracking, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35093.json

Published

Apr 1, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35087Slican telephone exchanges allow administrative protocol aut…9.3
• CVE-2026-35089In Slican telephone exchanges secure key is generated in a p…8.7
• CVE-2026-3509An unauthenticated remote attacker may be able to control th…7.5
• CVE-2026-35090In Slican telephone exchanges it is possible to manage the c…9.3
• CVE-2026-35091A flaw was found in Corosync. A remote unauthenticated attac…8.2
• CVE-2026-35092A flaw was found in Corosync. An integer overflow vulnerabil…7.5
• CVE-2026-35094A flaw was found in libinput. An attacker capable of deployi…5.5
• CVE-2026-35095KTM System e-BOK allows the session identifier to be set by …4.8
• CVE-2026-35096KTM System e-BOK is vulnerable to Cross‑Site Request Forgery…5.1
• CVE-2026-35097KTM System e-BOK enforces a maximum password length of six n…6.9
• CVE-2026-35098KTM System e-BOK does not implement any limit or timeout on …6.9
• CVE-2026-35099Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condi…7.4