The vulnerability CVE-2026-50292 affects freedesktop libinput versions prior to 1.30.4 and 1.31.x before 1.31.3. It is caused by improper neutralization of CRLF sequences (CWE-93) in the libinput-device-group's handling of phys output, which is not properly escaped. This allows injection of udev properties, potentially enabling an attacker to execute arbitrary code with root privileges. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and no privileges or user interaction, but results in high impact on confidentiality, integrity, and availability. No official patch or remediation level is documented in the provided data, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to arbitrary code execution with root privileges on affected systems. This compromises system confidentiality, integrity, and availability. The attack requires local access and has high complexity, but does not require privileges or user interaction. No known exploits have been reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid running vulnerable versions in untrusted environments and monitor for updates from freedesktop. No vendor advisory or official patch information is currently available.