Paper/Archive/CVE-2026-50292

CVE-2026-50292

freedesktop libinput — In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arb…

EPSS 0.3%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 24.2.242 × 204.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

Affected

ProductAffectedFixed inSource

libinput< 1.30.41.30.4CNA

libinput1.31.0 – < 1.31.31.31.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mitre (CNA)7.4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgitlab.freedesktop.org/libinput/libinput/-/work_items/1296 refgitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e2868882864b4611281f12f704b55 refopenwall.com/lists/oss-security/2026/06/04/5