CVE-2026-108094
Received Received - Intake

Use-After-Free in GNOME Mutter Wayland Color-Management

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: redhat-SADP

Description
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108094
EUVD
EUVD-2026-97472

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the mutter window manager, specifically in the Wayland color-management ICC image-description path. A local attacker running a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

Detection Guidance

To detect this vulnerability, check the installed version of mutter on your system. Run: rpm -q mutter on Red Hat-based systems or apt list --installed mutter on Debian-based systems. If the version is between 49.0 and 50.4, the system is vulnerable. Also monitor for GNOME session crashes or compositor instability.

Impact Analysis

An attacker with local access could exploit this to crash your GNOME session or execute arbitrary code within the compositor process. This could lead to system instability, unauthorized access, or further compromise of your system if the attacker gains control of the compositor.

Compliance Impact

This vulnerability primarily affects system integrity and availability by allowing arbitrary code execution within the compositor process, which could lead to unauthorized access or control of the system. For compliance standards like GDPR or HIPAA, this could mean increased risk of data breaches or unauthorized data access if exploited, potentially violating confidentiality requirements. However, the provided context does not explicitly link this vulnerability to specific compliance violations or regulatory impacts.

Mitigation Strategies

Update mutter to version 50.5 or 51.0 or later. If updating is not immediately possible, avoid running untrusted applications in Wayland sessions or restrict Wayland socket access for untrusted clients. Consider switching to X11 sessions as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart