{"id":"UBUNTU-CVE-2026-108094","details":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.","modified":"2026-10-17T12:58:01.793542124Z","published":"2026-10-12T15:17:00Z","upstream":["CVE-2026-108094"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-108094"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-108094"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-108094"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2549511"}],"affected":[{"package":{"name":"mutter","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.4-0ubuntu1","3.18.1-1ubuntu2","3.18.2-0ubuntu1","3.18.3-0ubuntu1","3.18.3-0ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-mutter-3.0","binary_version":"3.18.3-0ubuntu2"},{"binary_version":"3.18.3-0ubuntu2","binary_name":"libmutter0g"},{"binary_name":"mutter","binary_version":"3.18.3-0ubuntu2"},{"binary_version":"3.18.3-0ubuntu2","binary_name":"mutter-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}},{"package":{"name":"mutter","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-2ubuntu1","3.26.1-2ubuntu2","3.26.1-6","3.26.2-0ubuntu1","3.26.2-1","3.26.2-1build1","3.27.91-1","3.27.92-1","3.28.0-1","3.28.0-2","3.28.1-1","3.28.1-1ubuntu1","3.28.2-2~ubuntu18.04.1","3.28.3-2~ubuntu18.04.1","3.28.3-2~ubuntu18.04.2","3.28.3+git20190124-0ubuntu18.04.2","3.28.4-0ubuntu18.04.1","3.28.4-0ubuntu18.04.2","3.28.4+git20200505-0ubuntu18.04.2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.28.4+git20200505-0ubuntu18.04.2","binary_name":"gir1.2-mutter-2"},{"binary_version":"3.28.4+git20200505-0ubuntu18.04.2","binary_name":"libmutter-2-0"},{"binary_version":"3.28.4+git20200505-0ubuntu18.04.2","binary_name":"mutter"},{"binary_name":"mutter-common","binary_version":"3.28.4+git20200505-0ubuntu18.04.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}},{"package":{"name":"mutter","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-1ubuntu1","3.34.1+git20191022-2ubuntu1","3.34.1+git20191107-1ubuntu1","3.34.2-2ubuntu1","3.34.3-1ubuntu1","3.35.91-1ubuntu1","3.36.0-2ubuntu1","3.36.1-3ubuntu1","3.36.1-3ubuntu2","3.36.1-3ubuntu3","3.36.2-1ubuntu1~20.04.1","3.36.3-0ubuntu0.20.04.1","3.36.4-0ubuntu0.20.04.2","3.36.6-1ubuntu0.20.04.2","3.36.7+git20201123-0.20.04.1","3.36.9-0ubuntu0.20.04.1","3.36.9-0ubuntu0.20.04.2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.36.9-0ubuntu0.20.04.2","binary_name":"gir1.2-mutter-6"},{"binary_name":"libmutter-6-0","binary_version":"3.36.9-0ubuntu0.20.04.2"},{"binary_name":"mutter","binary_version":"3.36.9-0ubuntu0.20.04.2"},{"binary_version":"3.36.9-0ubuntu0.20.04.2","binary_name":"mutter-common"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}},{"package":{"name":"mutter","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["40.5-1ubuntu2","40.5-1ubuntu3","41.3-1ubuntu1","41.3-1ubuntu5","41.3-3ubuntu1","42~beta-1ubuntu2","42.0-1ubuntu1","42.0-3ubuntu1","42.0-3ubuntu2","42.1-0ubuntu1","42.2-0ubuntu1","42.5-0ubuntu1","42.9-0ubuntu1","42.9-0ubuntu4","42.9-0ubuntu5","42.9-0ubuntu7","42.9-0ubuntu7.1","42.9-0ubuntu8","42.9-0ubuntu9"],"ecosystem_specific":{"binaries":[{"binary_version":"42.9-0ubuntu9","binary_name":"gir1.2-mutter-10"},{"binary_version":"42.9-0ubuntu9","binary_name":"libmutter-10-0"},{"binary_name":"libmutter-test-10","binary_version":"42.9-0ubuntu9"},{"binary_version":"42.9-0ubuntu9","binary_name":"mutter"},{"binary_name":"mutter-10-tests","binary_version":"42.9-0ubuntu9"},{"binary_name":"mutter-common","binary_version":"42.9-0ubuntu9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}},{"package":{"name":"mutter","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["45.0-3ubuntu3","45.0-3ubuntu4","45.2-1ubuntu1","45.2-3ubuntu1","45.3-1ubuntu1","46.0-1ubuntu6","46.0-1ubuntu7","46.0-1ubuntu9","46.2-1ubuntu0.24.04.1","46.2-1ubuntu0.24.04.2","46.2-1ubuntu0.24.04.4","46.2-1ubuntu0.24.04.5","46.2-1ubuntu0.24.04.6","46.2-1ubuntu0.24.04.7","46.2-1ubuntu0.24.04.8","46.2-1ubuntu0.24.04.9","46.2-1ubuntu0.24.04.10","46.2-1ubuntu0.24.04.12","46.2-1ubuntu0.24.04.13","46.2-1ubuntu0.24.04.14","46.2-1ubuntu0.24.04.15","46.2-1ubuntu0.24.04.16","46.2-1ubuntu0.24.04.18"],"ecosystem_specific":{"binaries":[{"binary_version":"46.2-1ubuntu0.24.04.18","binary_name":"gir1.2-mutter-14"},{"binary_name":"libmutter-14-0","binary_version":"46.2-1ubuntu0.24.04.18"},{"binary_name":"libmutter-test-14","binary_version":"46.2-1ubuntu0.24.04.18"},{"binary_version":"46.2-1ubuntu0.24.04.18","binary_name":"mutter"},{"binary_version":"46.2-1ubuntu0.24.04.18","binary_name":"mutter-14-tests"},{"binary_version":"46.2-1ubuntu0.24.04.18","binary_name":"mutter-common"},{"binary_name":"mutter-common-bin","binary_version":"46.2-1ubuntu0.24.04.18"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}},{"package":{"name":"mutter","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["50.1-0ubuntu2","50.1-0ubuntu4","51~alpha-0ubuntu2","51~beta-1ubuntu2","51.0-1ubuntu2","51.0-1ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-mutter-51","binary_version":"51.0-1ubuntu3"},{"binary_version":"51.0-1ubuntu3","binary_name":"libmutter-51-0"},{"binary_name":"libmutter-test-51","binary_version":"51.0-1ubuntu3"},{"binary_version":"51.0-1ubuntu3","binary_name":"mutter"},{"binary_version":"51.0-1ubuntu3","binary_name":"mutter-51-tests"},{"binary_name":"mutter-common","binary_version":"51.0-1ubuntu3"},{"binary_name":"mutter-common-bin","binary_version":"51.0-1ubuntu3"},{"binary_name":"mutter-dev-bin","binary_version":"51.0-1ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}},{"package":{"name":"mutter","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/mutter?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["49.0-2ubuntu5","49.0-2ubuntu6","49.1.1-2ubuntu1","49.2-1ubuntu1","50~beta-2ubuntu3","50~beta-2ubuntu4","50.0-0ubuntu1","50.0-0ubuntu2","50.0-0ubuntu3","50.0-0ubuntu4","50.0-0ubuntu5","50.0-0ubuntu6","50.1-0ubuntu2","50.1-0ubuntu2.1","50.1-0ubuntu2.2","50.1-0ubuntu2.4"],"ecosystem_specific":{"binaries":[{"binary_name":"gir1.2-mutter-18","binary_version":"50.1-0ubuntu2.4"},{"binary_name":"libmutter-18-0","binary_version":"50.1-0ubuntu2.4"},{"binary_name":"libmutter-test-18","binary_version":"50.1-0ubuntu2.4"},{"binary_version":"50.1-0ubuntu2.4","binary_name":"mutter"},{"binary_name":"mutter-18-tests","binary_version":"50.1-0ubuntu2.4"},{"binary_name":"mutter-common","binary_version":"50.1-0ubuntu2.4"},{"binary_name":"mutter-common-bin","binary_version":"50.1-0ubuntu2.4"},{"binary_name":"mutter-dev-bin","binary_version":"50.1-0ubuntu2.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}