A flaw in Libinput allows a local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories to bypass security restrictions. The attacker can then run arbitrary code with the same permissions as the program using Libinput, such as a graphical compositor. This can enable the attacker to monitor keyboard input and send the captured data to an external location. The vulnerability reflects CWE‑94, a form of malicious code injection that leads to unintended code execution.

Red Hat Enterprise Linux 7, 8, 9, 10 and Fedora 43 and 44 are affected because the Libinput package bundled with these distributions contains the vulnerable code. No specific package versions are listed, so any system running the packaged Libinput without the available remediation is susceptible.

The CVSS score of 8.8 indicates a high severity. An EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: the attacker must have write access to a directory where Libinput loads Lua plugins. Once such a file is in place, the compromise occurs immediately with the privileges of the Libinput‑using process.