CVE-2026-35093 (CVSS 8.8 HIGH) in freedesktop libinput allows unauthorized code execution and information disclosure through Lua bytecode plugins. Affected versions are libinput < 1.30.3 and libinput >= 1.30.4 < 1.31.1, including Fedora versions 43 and 44. The vulnerability is fixed in libinput versions 1.30.3 and 1.31.1.
We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking āManage Cookiesā at the bottom of the page. Privacy Statement Third-Party Cookies Accept Reject Manage cookies MSRC ī¬ Customer Guidance ī¬ Security Update Guide ī¬ Vulnerabilities ī¬ CVE-2026-35093 Your Privacy Choices Consumer Health Privacy