5.5
CVE-2026-35094
- EPSS 0.15%
- Veröffentlicht 01.04.2026 13:54:00
- Zuletzt bearbeitet 07.04.2026 16:25:48
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginLibinput: libinput: information disclosure via dangling pointer in lua plugin handling
A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.042 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| secalert@redhat.com | 3.3 | 1.8 | 1.4 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-825 Expired Pointer Dereference
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
https://access.redhat.com/security/cve/CVE-2026-35094
https://bugzilla.redhat.com/show_bug.cgi?id=2453840
https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272