CVE-2026-50292
High · 7.4CVSS
7.4
EPSS
0.5%
Published
Jun 4, 2026
CISA due date
—
The record
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | libinput | 0 | 1.28.1-160000.3.1 |
| openSUSE:Leap 16.0 | libinput-extra | 0 | 1.28.1-160000.3.1 |
Related vulnerabilities
- CVE-2026-50265 Rejected reason: This CVE ID was assigned as a duplicate of CVE-2026-50292 Also affects libinput
- CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93
- CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. CWE-93
- CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters… CWE-93
- CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks… CWE-93
- CVE-2026-48019 Laravel is a web application framework. CWE-93
- CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows… CWE-93