CVE-2026-35094CWE-825

Libinput: libinput: information disclosure via dangling pointer in lua plugin handling

Low · published April 1, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00172 · 6.2th percentile
Weakness
CWE-825 · Expired Pointer Dereference
Published
2026-04-01T13:54Z
EPSS history
Timeline
  • 01 APR 13:54Z
    Libinput: libinput: information disclosure via dangling pointer in lua plugin handling
    cvelistv5