Live › vulnerability › CVE-2026-121604
wlroots before 0.20.2 reads past the end of a WM_CLASS property in its Xwayland code, so a local X11 client can make the compositor expose heap bytes as a window class or app_id over IPC. The attacker gets leaked compositor memory, which may contain sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Only Wayland compositors built on wlroots that run Xwayland are exposed, because the flaw is in the X11 window manager code. Attackers need a local X11 client on the same machine. Systems with no Xwayland or a wlroots version at or above 0.20.2 can skip it.
No product ranges from the sources yet.
pkg-config --modversion wlroots or the version your compositor bundles.0.20.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.
This page as .md · .json · in your agent: get_signal("CVE-2026-121604")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.