Hi,

The following vulnerability was published for mutter.

CVE-2026-108094[0]:
| A use-after-free flaw was found in mutter in the Wayland color-
| management ICC image-description path. A local attacker who can run
| a malicious Wayland client can destroy a wp_image_description_v1
| resource while an asynchronous ICC file read is still in progress.
| When the read completes, the compositor uses the freed wl_resource,
| writes into freed memory, and frees a pointer derived from that
| memory. This can crash the GNOME session and may allow arbitrary
| code execution within the compositor process.

https://bugzilla.redhat.com/show_bug.cgi?id=2549511
https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108094
https://www.cve.org/CVERecord?id=CVE-2026-108094

Please adjust the affected versions in the BTS as needed.

Version: 50.5-1

It looks like this issue was already fixed in upstream 50.5. I haven't
checked whether Debian 13 is affected. The Red Hat bug suggests that
mutter 48 might not be affected but the wording is confusing.

Thank you,
Jeremy Bícha

Hi Jeremy,
source file at least as well:

Contents-source-sid.gz:src/3rdparty/chromium/third_party/mutter/src/src/wayland/meta-wayland-color-management.c    qt6-webengine
Contents-source-sid.gz:src/wayland/meta-wayland-color-management.c mutter
Contents-source-trixie.gz:src/wayland/meta-wayland-color-management.c      mutter

but have not inspected the code further, but Red Hat bugzilla say
similar:

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creator_icc_create / on_icc_create_bytes_read)
Version affected (maintainer): >= 47.0, < 51.0
Version fixed (maintainer): 51.0

but if futher investigation shows 48 from trixie is not shipping the
code then we can update the tracker!

Regards,
Salvatore