CVE-2026-50292: In libinput before 1

Synopsis

This is a privilege-escalation and arbitrary code execution vulnerability in libinput, the Linux input-device handling library. An attacker with an existing foothold on the host (no network access or authentication required) can exploit unescaped physical-device output in libinput-device-group to inject malicious udev properties, which the system then processes with root privileges. Successful exploitation gives the attacker full root-level code execution on the affected host. Patched-image rebuilds at versions 1.30.4 and 1.31.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationNot required

  No account or credential is needed to trigger the vulnerability once local access to the host is established.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from another user or administrator.

• Attack complexityDetail

  Exploitation involves race conditions, specific memory layout dependencies, or other environmental factors that make a reliable exploit harder to construct but not impossible.

Blast Radius

• The attacker executes arbitrary code as root on the affected host, gaining full control of the operating system.
• All data accessible to the root user (credentials, secrets, application data) is readable by the attacker.
• The attacker can modify or delete any file on the host, including system binaries, configuration, and persisted application state.
• The attacker can crash or destabilize any service running on the host, causing a full denial of service.