CVE-2026-108094— Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Mutter 的 Wayland 色彩管理 ICC 图像描述路径中，发现了一个使用后释放（use-after-free）漏洞。本地攻击者若能运行恶意的 Wayland 客户端，可在异步读取 ICC 文件的过程中，销毁 wp_image_description_v1 资源。当读取操作完成时，合成器（compositor）会使用已释放的 wl_resource，向已释放的内存中写入数据，并释放该内存派生出的指针。此漏洞可能导致 GNOME 会话崩溃，并可能在合成器进程中实现任意代码执行。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108094
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
Source: CVE Program / CVE List V5
Vulnerability Description
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-108094
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108094
请登录查看更多情报信息。
Other References for CVE-2026-108094 (2)
Same Patch Batch · Red Hat · 2026-10-12 · 12 CVEs total
| CVE-2026-87744 | 9.1 CRITICAL | Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest |
| CVE-2026-75888 | 7.7 HIGH | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch |
| CVE-2026-83535 | 7.4 HIGH | Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-ti |
| CVE-2026-109082 | 6.8 MEDIUM | Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for pub |
| CVE-2026-94451 | 6.5 MEDIUM | Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: informat |
| CVE-2026-107193 | 6.5 MEDIUM | Foreman: api filter lookup ignores a search-limited filter permission |
| CVE-2026-85471 | 6.4 MEDIUM | Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable |
| CVE-2026-109194 | 6.4 MEDIUM | Quay: build trigger uuid idor in quay api |
| CVE-2026-107203 | 5.4 MEDIUM | Foreman: domain and subnet interface api skips host search filters |
| CVE-2026-83536 | 5.3 MEDIUM | Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris) |
| CVE-2026-109195 | 3.1 LOW | Quay: repository auto-prune policy uuid idor in quay api |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference i -
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme -
CVE-2026-107565
Luksmeta: incomplete gap-boundary and overlap checks in luks -
CVE-2026-107466
Flatpak-builder: local file exfiltration via `file
Same vendor: Red Hat
-
CVE-2026-83535
Openstack-network-exporter: basic-auth uses plaintext passwo -
CVE-2026-83536
Openstack-network-exporter: http.server has no readheadertim -
CVE-2026-85471
Quay: quay: webhook notification ssrf -- hostname-string blo -
CVE-2026-87744
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing -
CVE-2026-75888
Openshift/console: openshift/console: authenticated ssrf via
Same weakness: CWE-416
-
CVE-2026-85965
Use-after-free in Progress MarkLogic Server JavaScript engin -
CVE-2026-109268
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use Aft -
CVE-2026-109254
FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Discon -
CVE-2026-19935
Use-after-free of an L2CAP CoC channel object in the Zephyr -
CVE-2026-108539
GPAC MP4Box filter_queue.c gf_fq_pop use after free
V. Comments for CVE-2026-108094
No comments yet