Critical InputPlumber Vulnerabilities Allows UI Input Injection and Denial-of

Cybersecuritynews •Abinaya • January 12, 2026

Critical vulnerabilities in InputPlumber, a Linux input device utility used in SteamOS, could allow attackers to inject UI inputs and cause denial-of-service conditions on affected systems. The SUSE researchers tracked as CVE-2025-66005 and CVE-2025-14338, which affect InputPlumber versions before v0.69.0 and stem from inadequate D-Bus authorization mechanisms. InputPlumber combines Linux input devices into virtual input devices and runs […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical InputPlumber Vulnerabilities Enable UI Input Injection and DoS Critical vulnerabilities in InputPlumber, a Linux input device utility for SteamOS, could allow attackers to inject UI inputs and cause denial-of-service conditions on affected systems. The vulnerabilities, tracked as CVE-2025-66005 and CVE-2025-14338, affect InputPlumber versions prior to v0.69.0 and are due to inadequate D-Bus authorization mechanisms. 3 sources 45

Extracted Entities

Critical InputPlumber Vulnerabilities Allows UI Input Injection and Denial-of

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (4)