CVE-2026-35093 is a code injection vulnerability in libinput on Red Hat Enterprise Linux 10. A local attacker with the ability to place a malicious Lua bytecode file in specific system or user configuration directories can bypass security controls and execute arbitrary code with the privileges of the program using libinput. This flaw could be exploited to monitor keyboard input and send captured data externally. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The CVSS 3.1 base score is 8.8, indicating high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No explicit affected versions or patch information are provided in the input data. The vendor advisory link is available but does not contain explicit patch or remediation details in the provided content.

Successful exploitation allows a local attacker to execute unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This can lead to monitoring of keyboard input and exfiltration of sensitive information. The vulnerability impacts confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-35093 for current remediation guidance. Until an official fix is available, restrict local access to trusted users and monitor for suspicious activity related to configuration directories where Lua bytecode files could be placed.