CVE-2026-121604 in wlroots
Summary
by MITRE • 11/03/2026
wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in wlroots versions prior to 0.20.2 represents a critical memory safety flaw within the Xwayland subsystem, specifically located in the read_surface_class function found in xwayland/xwm.c. This component is responsible for managing window management properties for applications running under the X11 compatibility layer on Wayland compositors. The core technical issue stems from an improper boundary check when parsing WM_CLASS properties provided by local X11 clients. In a standard compliant scenario, both the instance and class strings within this property should be properly null-terminated to ensure safe string handling operations. However, wlroots failed to validate that the class portion of the property was correctly terminated before attempting to read or copy it into internal data structures.
This lack of validation leads directly to an out-of-bounds heap memory read operation. When a malicious local X11 client sets a WM_CLASS property with a valid NUL-terminated instance string but leaves the class string unterminated, the wlroots code continues reading past the end of the allocated buffer for that string. This over-read condition allows the application to access adjacent memory regions on the heap. The data retrieved from these out-of-bounds locations is then exposed back to the attacker through standard IPC mechanisms as part of the window class or app_id metadata. Consequently, this flaw facilitates a local information disclosure vulnerability where sensitive internal state of the compositor can be leaked to unprivileged processes running within the same user session.
From an operational impact perspective, while the attack vector requires local access and typically implies that the attacker already has some level of code execution or interaction capability with the X11 environment, the consequences are significant for privacy and potentially security posture. The leakage of heap memory can reveal pointers to other objects in memory, which may aid in further exploitation attempts such as bypassing Address Space Layout Randomization (ASLR) if combined with other vulnerabilities. Additionally, leaking internal compositor data could expose details about active windows, application states, or configuration parameters that were not intended for public consumption by client applications. This undermines the isolation guarantees expected between different processes and compromises the confidentiality of system resources managed by the display server infrastructure.
This vulnerability aligns closely with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1005, Data from Local System, specifically under sub-techniques involving memory scraping or reading local system information for reconnaissance purposes. The exploitation relies on the attacker's ability to interact with X11 properties, which maps to lateral movement or privilege escalation contexts depending on the surrounding environment and trust boundaries within the desktop session.
To mitigate this risk, it is imperative that organizations running wlroots-based compositors such as Sway, Hyprland, or Wayfire upgrade immediately to version 0.20.2 or later where this boundary check has been corrected. The fix ensures that both instance and class strings are validated for proper termination before being processed by the surface reading logic. For environments where immediate patching is not feasible due to dependency constraints, implementing strict input validation at the X11 client level can serve as a temporary compensating control, although this shifts responsibility away from the compositor's inherent security model. Regular auditing of third-party libraries and maintaining up-to-date package repositories are essential practices for minimizing exposure to such memory corruption flaws in display server software.