important · Windows privilege
Any local Windows user can turn Input Leap’s service into a persistent SYSTEM command runner.
Affects
Input Leap, an open-source keyboard-and-mouse sharing application whose Windows service launches its client or server process across desktop sessions.
An ordinary process connects to the unauthenticated localhost service, supplies a command and elevation byte, and causes the watchdog to duplicate the winlogon token and call CreateProcessAsUser. The daemon retains the command for execution after restart.
Detail and 7 sources
The upstream repository is archived and no fixed release is available.
Sources
Research[oss-security] [NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEMCode / PoCinput-leap/src/lib/ipc/Ipc.h at v3.0.3 · input-leap/input-leap · GitHubCode / PoCinput-leap/src/lib/ipc/IpcServer.cpp at v3.0.3 · input-leap/input-leap · GitHubCode / PoCinput-leap/src/lib/ipc/IpcClientProxy.cpp at v3.0.3 · input-leap/input-leap · GitHubCode / PoCinput-leap/src/lib/platform/MSWindowsWatchdog.cpp at v3.0.3 · input-leap/input-leap · GitHubCode / PoCinput-leap/src/lib/arch/win32/ArchDaemonWindows.cpp at v3.0.3 · input-leap/input-leap · GitHubCode / PoCReleases · input-leap/input-leap · GitHub