{"id":"CVE-2026-50265","aliases":["EUVD-2026-34795","GHSA-h66j-7rgr-pmgx","SUSE-SU-2026:22165-1","SUSE-SU-2026:2523-1","SUSE-SU-2026:2524-1","SUSE-SU-2026:2529-1","SUSE-SU-2026:2530-1","UBUNTU-CVE-2026-50265","openSUSE-SU-2026:21091-1"],"status":"rejected","title":"A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary...","description":"This CVE ID was assigned as a duplicate of CVE-2026-50292","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-06-05T09:49:32Z","modified":"2026-06-30T18:24:39Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.0-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-150400.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libinput","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libinput-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.1-160000.3.1"}]}],"bundled":2}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50265"},{"url":"https://access.redhat.com/security/cve/CVE-2026-50265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485390","tags":["report"]},{"url":"https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/04/16","tags":["report"]},{"url":"https://github.com/advisories/GHSA-h66j-7rgr-pmgx"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622165-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267852","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50292","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262523-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262524-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262529-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262530-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-50265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50265","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50265","description":"This CVE ID was assigned as a duplicate of CVE-2026-50292","status":"rejected","published":"2026-06-05T09:49:32.832Z","modified":"2026-06-08T14:02:09.197Z","updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-34795","description":"This CVE ID was assigned as a duplicate of CVE-2026-50292","status":"published","published":"2026-06-05T09:49:32Z","modified":"2026-06-08T14:02:09Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:49.297547Z"}],"ghsa":[{"id":"GHSA-h66j-7rgr-pmgx","title":"A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary...","description":"A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.","status":"published","published":"2026-06-05T12:31:45Z","modified":"2026-06-05T12:31:53Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:08:34.365209Z"}],"nvd":[{"id":"CVE-2026-50265","description":"Rejected reason: This CVE ID was assigned as a duplicate of CVE-2026-50292","status":"rejected","published":"2026-06-05T11:16:36.853Z","modified":"2026-06-08T15:16:48.55Z","updated_at":"2026-11-02T14:12:22.371367Z"}],"osv":[{"id":"UBUNTU-CVE-2026-50265","description":"Rejected reason: This CVE ID was assigned as a duplicate of CVE-2026-50292","status":"withdrawn","published":"2026-06-05T11:16:00Z","modified":"2026-06-12T09:04:22.261018754Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"openSUSE-SU-2026:21091-1","title":"Security update for libinput","description":"This update for libinput fixes the following issues\n\n- CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation (bsc#1267852).\n","status":"published","published":"2026-06-18T20:52:13Z","modified":"2026-06-30T18:24:39.80118416Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22165-1","title":"Security update for libinput","description":"This update for libinput fixes the following issues\n\n- CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation (bsc#1267852).\n","status":"published","published":"2026-06-18T20:52:25Z","modified":"2026-06-24T18:24:16.618333728Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2523-1","title":"Security update for libinput","description":"This update for libinput fixes the following issues\n\n- CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation (bsc#1267852).\n","status":"published","published":"2026-06-23T08:52:47Z","modified":"2026-06-24T09:00:14.622931296Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2524-1","title":"Security update for libinput","description":"This update for libinput fixes the following issues\n\n- CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation (bsc#1267852).\n","status":"published","published":"2026-06-23T08:53:00Z","modified":"2026-06-24T09:00:11.850784542Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2529-1","title":"Security update for libinput","description":"This update for libinput fixes the following issues\n\n- CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation (bsc#1267852).\n","status":"published","published":"2026-06-23T10:02:38Z","modified":"2026-06-24T09:00:11.885047735Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2530-1","title":"Security update for libinput","description":"This update for libinput fixes the following issues\n\n- CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation (bsc#1267852).\n","status":"published","published":"2026-06-23T10:03:18Z","modified":"2026-06-24T09:00:11.852611514Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}