CVE-2026-108094
Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Record
CVE-2026-108094- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-06
EUVDEUVD-2026-97472
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Record
EUVD-2026-97472- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-g8f9-h8x6-9c3x
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description...
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Record
GHSA-g8f9-h8x6-9c3x- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Record
CVE-2026-108094- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-108094
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Record
DEBIAN-CVE-2026-108094- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-108094
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
- Record
UBUNTU-CVE-2026-108094- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mutterDebian:12 |
All versions, plus listed versions 43.4-243.6-143.6-1~deb12u143.7-143.7-2 Show 45 moreShow less43.8-0+deb12u144.0-144.0-244.1-144.2-144.2-244.2-344.3-144.3-244.3-344.3-444.3-544.3-644.3-744.4-144.4-244.4-344.5-144.5-244.7-144.7-244.8-144.8-244.8-344.8-3.144.8-3.1+loong6444~beta-144~beta-244~beta-344~rc-145.0-145.0-245.0-345.1-145.1-245.2-145.2-245.2-345.3-145.3-245.3-345~beta.1-145~rc-145~rc-245~rc-3 |
None known |
mutterDebian:13 |
All versions, plus listed versions 48.4-248.5-148.7-0+deb13u149.0-149.0-2 Show 23 moreShow less49.0-349.1-149.1.1-149.1.1-249.2-149.3-149.4-149~rc-150.0-150.1-150.2-150.2-250.2-350.2-450.3-150.4-150.5-150~beta-150~beta-251.0-151.0-251.0-351~beta-1 |
None known |
mutterDebian:14 |
before 50.5-1, plus listed versions 48.4-248.5-149.0-149.0-249.0-3 Show 17 moreShow less49.1-149.1.1-149.1.1-249.2-149.3-149.4-149~rc-150.0-150.1-150.2-150.2-250.2-350.2-450.3-150.4-150~beta-150~beta-2 |
50.5-1 |
mutterUbuntu:26.04:LTS |
All versions, plus listed versions 49.0-2ubuntu549.0-2ubuntu649.1.1-2ubuntu149.2-1ubuntu150~beta-2ubuntu3 Show 12 moreShow less50~beta-2ubuntu450.0-0ubuntu150.0-0ubuntu250.0-0ubuntu350.0-0ubuntu450.0-0ubuntu550.0-0ubuntu650.1-0ubuntu250.1-0ubuntu2.150.1-0ubuntu2.250.1-0ubuntu2.450.1-0ubuntu2.5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108094 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published October 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in mutter 50.5-1.
References
Left out here: 78 versions. The JSON record has them.