Out-of-Bounds Read Vulnerability in wlroots Affects Local X11 Clients
CVE-2026-121604

4.8MEDIUM

Key Information:

Vendor

Wlroots

Status
Wlroots
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121604?

The wlroots project, prior to version 0.20.2, has been identified to have an out-of-bounds read vulnerability in the read_surface_class() method located in the source file xovm.c. This vulnerability allows local X11 clients to exploit a flaw in the code that permits the leakage of compositor heap memory. By manipulating the WM_CLASS property with a NUL-terminated instance coupled with an unterminated class, attackers are able to expose bytes from heap memory during inter-process communication (IPC) operations, potentially exposing sensitive data.

Affected Version(s)

wlroots 0 < 0.20.2

References

https://gitlab.freedesktop.org/wlroots/wlroots/-/work_ite...
issue-tracking
https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_re...
issue-tracking
https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/8...
patch

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
Simon Ser
.