Read the docs
TI-2026-84410 Aliases CVE-2026-121604GHSA-ww5w-hv3v-hp9v

Out-of-bounds read in wlroots window class handling leaks heap memory

Priority LOW 21CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

wlroots before 0.20.2 contains an out-of-bounds read in read_surface_class() in xwayland/xwm.c. A local X11 client that sets a WM_CLASS property with a NUL-terminated instance but an unterminated class can leak compositor heap memory, which is exposed as the window class or app_id over IPC. The flaw is tracked as CWE-125.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00111 1st percentileScored 2026-11-07
Fix Fixed wlroots (wlroots): 0.20.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wlrootswlrootsbefore 0.20.20.20.2Patch availableCNA
  • wlroots Vendorwlroots Affected before 0.20.2 Fixed in 0.20.2 Patch available CNA

Remediation

Update wlroots to version 0.20.2, which fixes the flaw. The sources list no further vendor advisory for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA wlroots (wlroots) Fixed in 0.20.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121604
  2. 2026-11-03 Alias added: GHSA-ww5w-hv3v-hp9v
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat
  5. 2026-11-07 CISA SSVC decision points changed

References

Patch 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences