wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read surface class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app id over IPC.