wlroots EUVD-2026-116039

Exploitation requires the wlroots-based compositor to have XWayland support active (the vulnerable code path is read_surface_class() in xwayland/xwm.c). The attacker must be a local X11 client within an existing session (PR:L) capable of setting a WM_CLASS property crafted with a NUL-terminated instance string but a non-NUL-terminated class string. Limiting factors: local access only (AV:L, no remote exploitation), the compositor must use wlroots earlier than 0.20.2, and the impact is confined to disclosure of a bounded quantity of compositor heap bytes surfaced as the window class/app_id - there is no integrity or availability impact and no user interaction is required.

This is a genuine but low-urgency issue, not a high-severity emergency. The input CVSS 4.0 base score is 4.8 (medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N and impact limited to VC:L (low confidentiality only; VI:N/VA:N - no integrity or availability impact), meaning exploitation requires local access and an already-authenticated low-privilege X11 client, and yields only a bounded heap-memory leak. No EPSS score is provided in the input, so exploitation probability cannot be quantified. KEV status is not listed (no CISA active-exploitation signal), and no public exploit code is identified among the references. The vuln.today decision label is 'this_month,' consistent with routine patching rather than crisis response. The signals are internally consistent: a local-vector, low-privilege, information-disclosure flaw with a vendor patch available. The main caveat is the absence of an EPSS value, so widespread-vs-targeted exploitation likelihood is unverified; however, the AV:L local requirement inherently caps real-world reach to attackers who already have a session on the host.

A local user with an active session on a machine running a wlroots-based Wayland compositor with XWayland enabled launches an X11 client that sets a crafted WM_CLASS property - a NUL-terminated instance string followed by an unterminated class string. The compositor's read_surface_class() over-reads past the buffer and returns adjacent compositor heap bytes to the client as the window class/app_id over IPC, leaking memory contents. No public exploit code is identified, though the trigger is straightforward for any local X11 client.