Security readout for executives and security teams
Plain-English summary
CVE-2026-35093 is a high-severity libinput flaw. A local user who can place crafted Lua bytecode in certain configuration locations may make software using libinput run unauthorized code. The main business risk is workstation compromise, including possible keyboard monitoring and data theft from graphical sessions.
Executive priority
Handle as high priority for Linux desktop fleets and shared graphical systems. The weakness is local, which limits broad internet-scale exposure, but potential keyboard monitoring creates meaningful credential and sensitive-data risk. Prioritize validation before emergency disruption where vendor impact is listed as unaffected.
Technical view
The flaw involves Lua bytecode plugins in libinput bypassing intended security restrictions. Exploitation requires local privileges and placement of a crafted bytecode file in specific system or user configuration directories. Code may execute with the permissions of the libinput consumer, such as a graphical compositor, causing confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most relevant to Linux desktop or graphical systems using libinput and Lua plugin support. Red Hat lists RHEL 8, 9, and 10 as unaffected, while RHEL 7 status is unknown in the supplied bundle. Non-Red Hat exposure is not established by the provided sources.
Exploitation context
The supplied sources do not show active exploitation, and the CVE is not marked KEV. The attack is local, not remote, but it can become serious where users can write to relevant configuration paths on shared workstations, kiosks, jump hosts, or developer desktops.
Researcher notes
Evidence is incomplete on exact affected upstream versions, fixed releases, and non-Red Hat distributions. Do not assume RHEL 8, 9, or 10 are affected based on the supplied Red Hat status. Focus research on plugin loading behavior, configuration trust boundaries, and vendor advisories without publishing weaponizable details.
Mitigation direction
- Check libinput and OS vendor advisories for fixed packages or official mitigations.
- Prioritize systems where untrusted local users can access graphical sessions.
- Review write access to libinput-related system and user configuration directories.
- Apply vendor-provided updates when available through supported channels.
- Treat RHEL 7 status as unresolved until Red Hat clarifies impact.
Validation and detection
- Inventory systems with libinput installed and graphical compositor usage.
- Confirm OS version and vendor impact status against the cited advisories.
- Check whether relevant configuration paths are writable by untrusted users.
- Review endpoint telemetry for unexpected libinput plugin or configuration changes.
- Track vendor issue updates for patch and mitigation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-35093 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26redhatCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- ADP timelineredhat-SADP
Made public.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Reported to Red Hat.
- Source timelineredhat
Reported to Red Hat.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-01T13:31:20.352Z: Reported to Red Hat.
- 2026-04-01T00:00:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2026-35093CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2453839CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1271CVE reference, redhat
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35093.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.