CVE-2026-108094

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

This issue affects mutter builds that include the vulnerable async ICC creator path (confirmed in 49.x through 50.4). It is fixed upstream in mutter 50.5 and 51.0 via merge request !5313. The maintainer-reported range (>= 47.0, < 51.0) is broader than the code path that carries this bug; 47.x and 48.x do not contain the vulnerable on_icc_create_bytes_read / image_desc_resource lifetime pattern.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run untrusted applications in the affected Wayland session. Limit Wayland socket access for untrusted clients.