Critical InputPlumber Flaw Enables UI Input Injection and Denial-of-Service

Security researchers disclosed two critical D-Bus authorization vulnerabilities in InputPlumber (CVE-2025-66005 and CVE-2025-14338) that allow local unprivileged users to test for restricted files, leak sensitive data, cause denial-of-service, bypass Polkit authentication, escalate privileges, and inject arbitrary keystrokes by creating virtual keyboard devices; the service runs as root and affects Linux distributions including SteamOS, with fixes available in InputPlumber v0.69.0 and SteamOS 3.7.20 — administrators should update immediately and review Polkit policies.