Threats affecting pkg:github/wlroots/wlroots

CVE-2026-121604 is an out-of-bounds read vulnerability in wlroots versions before 0.20.2. It occurs in the read_surface_class() function within xwayland/xwm.c, allowing local X11 clients to leak compositor heap memory. The flaw arises when attackers set a WM_CLASS property with a NUL-terminated instance but an unterminated class, causing over-read heap bytes to be exposed as the window class or app_id over IPC.