Critical InputPlumber Vulnerability Enables UI Input Injection and Denial-of

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical InputPlumber Vulnerabilities Enable UI Input Injection and DoS Critical vulnerabilities in InputPlumber, a Linux input device utility for SteamOS, could allow attackers to inject UI inputs and cause denial-of-service conditions on affected systems. The vulnerabilities, tracked as CVE-2025-66005 and CVE-2025-14338, affect InputPlumber versions prior to v0.69.0 and are due to inadequate D-Bus authorization mechanisms. 3 sources 45