DEBIAN-CVE-2026-108094

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-108094
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108094.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-108094
Upstream
  • CVE-2026-108094
Published
2026-10-12T15:17:07Z
Modified
2026-10-15T06:03:04Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

References

Affected packages

Debian:12 / mutter

Package

Name
mutter
Purl
pkg:deb/debian/mutter?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

43.*
43.4-2
43.6-1~deb12u1
43.6-1
43.7-1
43.7-2
43.8-0+deb12u1
Other
44~beta-1
44~beta-2
44~beta-3
44~rc-1
45~rc-1
45~rc-2
45~rc-3
45~rc-4
47~beta-1
47~beta-2
47~beta-3
47~rc-1
47~rc-2
47~rc-3
47~rc-4
47~rc-5
48~alpha-1
48~beta-1
48~beta-2
48~beta-3
48~beta-4
48~beta-5
48~beta-6
48~beta-7
48~rc-1
48~rc-2
48~rc-3
48~rc-4
49~rc-1
50~beta-1
50~beta-2
51~beta-1
44.*
44.0-1
44.0-2
44.1-1
44.2-1
44.2-2
44.2-3
44.3-1
44.3-2
44.3-3
44.3-4
44.3-5
44.3-6
44.3-7
44.4-1
44.4-2
44.4-3
44.5-1
44.5-2
44.7-1
44.7-2
44.8-1
44.8-2
44.8-3
44.8-3.1
44.8-3.1+loong64
45~beta.*
45~beta.1-1
45.*
45.0-1
45.0-2
45.0-3
45.1-1
45.1-2
45.2-1
45.2-2
45.2-3
45.3-1
45.3-2
45.3-3
46.*
46.0-1
46.1-1
46.1-2
46.2-1
46.3.1-1
46.3.1-2
46.3.1-2+loong64
46.3.1-3
46.3.1-4
46.3.1-5
46.3.1-6
46.3.1-7
46.4-1
47.*
47.0-1
47.0-2
47.0-3
47.1-1
47.1-2
47.1-3
47.1-4
47.3-1
47.3-2
47.4-1
48.*
48.0-1
48.1-1
48.1-2
48.2-1
48.3.1-1
48.3.1-2
48.4-1
48.4-2
48.5-1
49.*
49.0-1
49.0-2
49.0-3
49.1-1
49.1.1-1
49.1.1-2
49.2-1
49.3-1
49.4-1
50.*
50.0-1
50.1-1
50.2-1
50.2-2
50.2-3
50.2-4
50.3-1
50.4-1
50.5-1
51.*
51.0-1
51.0-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108094.json"

Debian:13 / mutter

Package

Name
mutter
Purl
pkg:deb/debian/mutter?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

48.*
48.4-2
48.5-1
48.7-0+deb13u1
Other
49~rc-1
50~beta-1
50~beta-2
51~beta-1
49.*
49.0-1
49.0-2
49.0-3
49.1-1
49.1.1-1
49.1.1-2
49.2-1
49.3-1
49.4-1
50.*
50.0-1
50.1-1
50.2-1
50.2-2
50.2-3
50.2-4
50.3-1
50.4-1
50.5-1
51.*
51.0-1
51.0-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108094.json"

Debian:14 / mutter

Package

Name
mutter
Purl
pkg:deb/debian/mutter?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
50.5-1

Affected versions

48.*
48.4-2
48.5-1
Other
49~rc-1
50~beta-1
50~beta-2
49.*
49.0-1
49.0-2
49.0-3
49.1-1
49.1.1-1
49.1.1-2
49.2-1
49.3-1
49.4-1
50.*
50.0-1
50.1-1
50.2-1
50.2-2
50.2-3
50.2-4
50.3-1
50.4-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-108094.json"