CVE-2026-121604 — Vulnerability intelligence
—
Published:
- CVSS
- 4.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.