wlroots vulnerabilities

CVEs whose affected-version data names the wlroots package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-121604Low· 3.3

5d ago

wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instan…

▾ Sunlitwlroots · wlrootsEPSS 0.11%via CVEORG