CVE-2026-50265

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50265", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-06-04T14:55:24.012Z", "datePublished": "2026-06-05T09:49:32.832Z", "dateUpdated": "2026-06-08T14:02:09.197Z", "dateRejected": "2026-06-08T14:02:09.197Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This CVE ID was assigned as a duplicate of CVE-2026-50292"}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-06-08T14:02:09.197Z"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50265", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-06-04T14:55:24.012Z", "datePublished": "2026-06-05T09:49:32.832Z", "dateUpdated": "2026-06-08T14:02:09.197Z", "dateRejected": "2026-06-08T14:02:09.197Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This CVE ID was assigned as a duplicate of CVE-2026-50292"}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-06-08T14:02:09.197Z"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID was assigned as a duplicate of CVE-2026-50292"}], "id": "CVE-2026-50265", "lastModified": "2026-06-08T15:16:48.550", "metrics": {}, "published": "2026-06-05T11:16:36.853", "references": [], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "libinput: local privilege escalation via crafted uinput devices", "id": "2485390", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485390"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system."], "mitigation": {"lang": "en:us", "value": "Restrict access to /dev/uinput to trusted users only. This is the default on virtually all distributions but some packages install udev rules that allow a logged-in user to create uinput devices. Examples for this on Fedora are steam-device, antimicrox, kdeconnectd."}, "name": "CVE-2026-50265", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libinput", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libinput", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libinput", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libinput", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50265\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50265\nhttps://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}], "created": "2026-06-05T11:30:39.454796+00:00", "updated": "2026-06-07T11:18:13.597613+00:00", "vendors": ["redhat", "redhat$PRODUCT$enterprise_linux"]}