Is CVE-2026-121604 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121604?

CVE-2026-121604 has a CVSS v3 severity of LOW (3.3).

Back

CVE-2026-121604

Description

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.