A flaw in libinput permits a local attacker with write access to system or user configuration directories to craft a Lua bytecode file that is loaded by libinput. When executed, the bytecode runs with the same privileges as the process that uses libinput, such as a graphical compositor. This enables the attacker to capture and transmit keyboard input, resulting in confidential data leakage. The vulnerability is a code‑injection weakness classified as CWE‑94 and carries a high severity rating of 8.8 on the CVSS scale.

Red Hat Enterprise Linux 7, 8, 9, and 10 are affected by this libinput flaw; no specific minor version information is available.

The CVSS score of 8.8 indicates a high severity risk. Exploitation requires local access and the ability to place a Lua bytecode file in a libinput configuration directory, but once achieved the attacker can execute arbitrary code and exfiltrate sensitive input. No publicly available exploit is listed, and the vulnerability is not yet in the CISA KEV catalog. Nonetheless, the potential impact warrants prompt remediation and monitoring.