CVE-2026-121604

A flaw was found in wlroots. An out-of-bounds read vulnerability in the XWayland window manager component allows a local user to cause an information disclosure. By providing an improperly terminated window class property, an attacker can read beyond allocated memory and expose compositor heap da...

CVE-2026-121604

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the...

EUVD-2026-116039

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the...

CVE-2026-121604: wlroots: wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that…

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the...

[SECURITY] Fedora 45 Update: xorg-x11-server-Xwayland-24.1.14-2.fc45

Xwayland is an X server for running X clients under Wayland...

Fedora 45 : xorg-x11-server-Xwayland (2026-6e2dcf8dd2)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6e2dcf8dd2 advisory. Backport a couple of fixups from upstream to fix a regression affecting proton games https://gitlab.freedesktop.org/xorg/xserver/-/workitems/1938 --...

umbra

Umbra An external overlay for THE FINALS on Linux. It reads the game's memory from a separate process, draws a transparent click-through window on top of it, and provides an aim assist and a triggerbot. Nothing is injected into the game and nothing is ever written back; the tool reads memory and...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146994)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146994 advisory. A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147036 advisory. A flaw was identified in the X.Org X servers X Keyboard Xkb extension where improper bounds checking in the XkbSetCompatMap function can cause an unsigned short...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147028)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147028 advisory. A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow. A client can trigger a use-after-free read after changing window attributes...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147029 advisory. A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and write...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147013)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147013 advisory. A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. XkbSetMapChecks declares a fixed-size stack buffer mapWidths256 indexed by key type...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147025)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147025 advisory. A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice function. This issue occurs when byte-swapped length values are...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147039)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147039 advisory. A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146999)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146999 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can lea...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147022)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147022 advisory. An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different maste...

AlmaLinux 9.2 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793286310)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793286310 advisory. - A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146997)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146997 advisory. An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147012 advisory. A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the hea...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147023)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147023 advisory. A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to...