CVE-2026-50292

Published: Giu 04, 2026 Last Modified: Giu 04, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 7,4

Source: [email protected]

Attack Vector: local

Attack Complexity: high

Privileges Required: none

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

Description

AI Translation Available

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity

Potential Impacts:

Modify Application Data

Applicable Platforms

All platforms may be affected

View CWE Details

https://gitlab.freedesktop.org/libinput/libinput/-/work_ite…

https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296

https://gitlab.freedesktop.org/libinput/libinput/-/commit/7…

https://gitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e286888286…