Game Over? Critical InputPlumber Flaws Expose Linux Gamers to Hijacking

A Linux gaming utility called InputPlumber has been found to harbour critical vulnerabilities that could let local attackers hijack sessions or crash systems, according to SUSE Security Team. The flaws, tracked as CVE-2025-66005 and CVE-2025-14338, arise from a failure to properly authenticate users interacting with the tool’s D-Bus service, and InputPlumber runs with root privileges, creating a direct path for privilege escalation.

Researchers demonstrated that an attacker could inject key presses into another user’s session by creating a virtual keyboard, potentially leading to arbitrary code execution in the context of the currently logged in user, and the CreateCompositeDevice method could be abused to reveal privileged files such as root’s bash history.

Following coordinated disclosure, upstream developers patched the flaws by default enabling Polkit authorization and securing the authentication subject in InputPlumber version v0.69.0, with SteamOS publishing new images for version 3.7.20 containing the fixes, as of 12 January 2026.