CVE-2026-35094
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Apr 1, 2026
CISA due date
—
The record
A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | libinput | 0 | 1.31.1-1.1 |
Related vulnerabilities
- CVE-2026-35093 A flaw was found in libinput. Also affects libinput
- CVE-2026-102010 A flaw was found in GCC. CWE-825
- CVE-2026-76891 Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CWE-825
- CVE-2026-76890 Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CWE-825
- CVE-2026-17523 A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged… CWE-825
- CVE-2026-54778 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-825
- CVE-2026-58592 Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its… CWE-825
- CVE-2026-12610 A flaw was found in sssd. CWE-825