SecuriTricks - CVE-2026-50265

Description

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.

Product(s) Impacted

Vendor	Product	Versions
Freedesktop	Libinput	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	freedesktop	libinput	/	/	/	/	/	/	/	/

References

https://access.redhat.com/security/cve/CVE-2026-50265

https://bugzilla.redhat.com/show_bug.cgi?id=2485390

https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296

http://www.openwall.com/lists/oss-security/2026/06/04/16

CVSS Score

7.0 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

View Vector String

Timeline

Published: June 5, 2026, 11:16 a.m.
Last Modified: June 5, 2026, 2:56 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-50265