---
id: CVE-2026-121604
title: wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c
summary: >-
  wlroots before 0.20.2 contains an out-of-bounds read vulnerability in
  read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak
  compositor heap memory. Attackers can set a WM_CLASS property with a
  NUL-terminated instan…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: wlroots
product: wlroots
affected:
  - wlroots < 0.20.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:14:25.336787Z'
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:14:36.532Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121604'
references:
  - url: 'https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4092'
  - url: 'https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5374'
  - url: >-
      https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/851cdd0089004884bd85a95ad21f04009cb5a53a
  - url: >-
      https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/4412992469540b1d578cb94a5cd4e6e5829812dc
  - url: 'https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.20.2'
  - url: >-
      https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.20.1/xwayland/xwm.c#L661-L678
  - url: >-
      https://www.vulncheck.com/advisories/wlroots-before-0.20.2-out-of-bounds-read-via-read-surface-class-in-xwm-c
    label: >-
      VulnCheck Advisory: wlroots before 0.20.2 Out-of-Bounds Read via
      read_surface_class() in xwm.c
tags:
  - cve.org
epss: 0.00111
epssPercentile: 0.01344
ingestedAt: '2026-11-05T20:33:06.285Z'
---

## Overview

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.

## Affected

- `wlroots < 0.20.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.