This vulnerability involves improper control of code generation in libinput on Red Hat Enterprise Linux 10. Specifically, a local attacker can place a malicious Lua bytecode file in system or user configuration directories, which libinput processes, leading to code injection. This enables execution of arbitrary code with the same privileges as the program using libinput, potentially compromising confidentiality and integrity by capturing keyboard input and sending it externally. The CVSS 3.1 score is 8.8 (high), reflecting local attack vector with low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the targeted program (e.g., graphical compositor). This can lead to sensitive data exposure such as keyboard input logging and unauthorized data exfiltration. The vulnerability impacts confidentiality, integrity, and availability of the affected system components. There are no reports of exploitation in the wild at this time.

Patch status is not confirmed from the provided information. Users should consult the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-35093 for current remediation guidance and apply any available updates or workarounds. Until patched, restrict local access to trusted users only and monitor for unauthorized file placements in configuration directories used by libinput.