CVE-2026-121604: wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c
wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or appid over IPC.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local X11 client can exploit it. The vulnerable parsing path is in wlroots' Xwayland window-manager handling, so exposure requires X11 clients to be able to interact with the compositor through Xwayland.
What must an attacker do to trigger the memory disclosure?
The attacker must set a WM_CLASS property whose instance portion is NUL-terminated but whose class portion is not terminated. This causes read_surface_class() to read beyond the property data and expose heap bytes as the window class or app_id over IPC.
What information may be exposed?
The issue can leak compositor heap memory. The over-read bytes may be surfaced through IPC in the window class or app_id value.
Which versions are affected?
wlroots versions before 0.20.2 are affected according to the available information.