Log in Start free

Vulnerability · Published Oct 12, 2026 · Assigned by redhat

CVE-2026-108094Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path

High 7.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 96.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mutterno fix listedDEBIAN-CVE-2026-108094
Debian:13mutterno fix listedDEBIAN-CVE-2026-108094
Debian:14mutter50.5-1DEBIAN-CVE-2026-108094
Ubuntu:26.04:LTSmutterno fix listedUBUNTU-CVE-2026-108094

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References