DEBIAN-CVE-2026-121604
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-121604
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-121604.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-121604
- Upstream
- Published
- 2026-11-03T17:18:11Z
- Modified
- 2026-11-06T17:29:22Z
- Severity
-
- 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.
- References
Affected packages
Debian:12 / wlroots
Package
- Name
- wlroots
- Purl
- pkg:deb/debian/wlroots?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
0.*
0.15.1-6
0.16.0-1
0.16.0-2
0.16.1-1
0.16.1-2
0.16.2-1
0.16.2-2
0.16.2-3
0.17.0-1~exp1
0.17.1-1
0.17.1-2
0.17.1-2.1~exp1
0.17.1-2.1
0.17.2-1
0.17.2-2
0.17.3-1
0.17.3-2
0.17.4-1
0.18.0-1
0.18.0-2
0.18.1-1
0.18.2-1
0.18.2-2
0.18.2-3
0.19.0~rc1-1
0.19.0~rc2-1
0.19.0-1
0.19.0-2
0.19.1-1
0.19.2-1
0.19.3-1
0.20.0~rc1-1
0.20.0~rc2-1
0.20.0~rc3-1
0.20.0~rc5-1
0.20.0-1
0.20.0-2
0.20.1-1
0.20.2-1
Debian:13 / wlroots
Package
- Name
- wlroots
- Purl
- pkg:deb/debian/wlroots?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / wlroots
Package
- Name
- wlroots
- Purl
- pkg:deb/debian/wlroots?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.20.2-1