mutter: A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path
CVE-2026-108094 is fixed in mutter on 1 platform by DEBIAN-CVE-2026-108094 (version 50.5-1), released October 16, 2026. It is not reported as exploited. Patch Radar priority: High.
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| mutter · Debian 14 | 50.5-1 | DEBIAN-CVE-2026-108094 | Oct 16, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.