DEBIAN-CVE-2026-121604: Debian/wlroots vulnerability

Q: Who is exposed to this issue?

Systems using wlroots versions before 0.20.2 are exposed when local X11 clients can interact with the Xwayland window manager component. The issue is triggered by a local X11 client.

Q: What must an attacker do to exploit it?

The attacker must set a WM_CLASS property whose instance portion is NUL-terminated while its class portion is not terminated. This causes read_surface_class() to read beyond the intended property data.

Q: What information can be exposed?

The out-of-bounds read can disclose compositor heap memory. The over-read bytes may be exposed as the window class or app_id through IPC.

Q: What should be done to remediate the issue?

Update wlroots to version 0.20.2 or later. The provided information does not specify an alternative mitigation when updating is not immediately possible.

Published Nov 3, 2026

Updated

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or appid over IPC.

Affected Software

3 affected componentsFixes available

debian/wlroots*

debian/wlroots<0.20.2-1

0.20.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/wlroots to a version that resolves this vulnerability.
Fixed in 0.20.2-1

Event History

Nov 3, 2026

CVE Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using wlroots versions before 0.20.2 are exposed when local X11 clients can interact with the Xwayland window manager component. The issue is triggered by a local X11 client.

What must an attacker do to exploit it?

The attacker must set a WM_CLASS property whose instance portion is NUL-terminated while its class portion is not terminated. This causes read_surface_class() to read beyond the intended property data.

What information can be exposed?

The out-of-bounds read can disclose compositor heap memory. The over-read bytes may be exposed as the window class or app_id through IPC.

What should be done to remediate the issue?

Update wlroots to version 0.20.2 or later. The provided information does not specify an alternative mitigation when updating is not immediately possible.

DEBIAN-CVE-2026-121604: Debian/wlroots vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What information can be exposed?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What information can be exposed?

What should be done to remediate the issue?