UBUNTU-CVE-2026-121604: Medium severity ubuntu/wlroots vulnerability

Published Nov 3, 2026

Updated

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or appid over IPC.

Affected Software

5 affected components

ubuntu/wlroots*

Event History

Nov 3, 2026

CVE Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using wlroots with Xwayland support are exposed to local X11 clients. The affected client must be able to create or control an X11 window and set its WM_CLASS property.

What does an attacker need to do to trigger the leak?

The attacker sets WM_CLASS so that the instance is NUL-terminated but the class portion is not terminated. This causes read_surface_class() to read beyond the property data and expose heap bytes through the window class or app_id over IPC.

What information can be exposed?

The issue can leak compositor heap memory. The exposed bytes may appear as the window class or app_id provided over IPC.

Are all wlroots versions affected?

The issue affects wlroots versions before 0.20.2. Version 0.20.2 and later are not identified as affected by the provided information.

UBUNTU-CVE-2026-121604: Medium severity ubuntu/wlroots vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the leak?

What information can be exposed?

Are all wlroots versions affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the leak?

What information can be exposed?

Are all wlroots versions affected?