UBUNTU-CVE-2026-108094

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-108094

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-108094

Upstream

CVE-2026-108094

Published

2026-10-12T15:17:00Z

Modified

2026-10-17T12:58:01Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

References

Affected packages

Ubuntu:16.04:LTS

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.16.4-0ubuntu1

3.18.1-1ubuntu2

3.18.2-0ubuntu1

3.18.3-0ubuntu1

3.18.3-0ubuntu2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-3.0",
            "binary_version":  "3.18.3-0ubuntu2"
        },
        {
            "binary_name":  "libmutter0g",
            "binary_version":  "3.18.3-0ubuntu2"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "3.18.3-0ubuntu2"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "3.18.3-0ubuntu2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"

Ubuntu:18.04:LTS

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.26.1-2ubuntu1

3.26.1-2ubuntu2

3.26.1-6

3.26.2-0ubuntu1

3.26.2-1

3.26.2-1build1

3.27.91-1

3.27.92-1

3.28.0-1

3.28.0-2

3.28.1-1

3.28.1-1ubuntu1

3.28.2-2~ubuntu18.04.1

3.28.3-2~ubuntu18.04.1

3.28.3-2~ubuntu18.04.2

3.28.3+git20190124-0ubuntu18.04.2

3.28.4-0ubuntu18.04.1

3.28.4-0ubuntu18.04.2

3.28.4+git20200505-0ubuntu18.04.2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-2",
            "binary_version":  "3.28.4+git20200505-0ubuntu18.04.2"
        },
        {
            "binary_name":  "libmutter-2-0",
            "binary_version":  "3.28.4+git20200505-0ubuntu18.04.2"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "3.28.4+git20200505-0ubuntu18.04.2"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "3.28.4+git20200505-0ubuntu18.04.2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"

Ubuntu:20.04:LTS

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.34.1-1ubuntu1

3.34.1+git20191022-2ubuntu1

3.34.1+git20191107-1ubuntu1

3.34.2-2ubuntu1

3.34.3-1ubuntu1

3.35.91-1ubuntu1

3.36.0-2ubuntu1

3.36.1-3ubuntu1

3.36.1-3ubuntu2

3.36.1-3ubuntu3

3.36.2-1ubuntu1~20.04.1

3.36.3-0ubuntu0.20.04.1

3.36.4-0ubuntu0.20.04.2

3.36.6-1ubuntu0.20.04.2

3.36.7+git20201123-0.20.04.1

3.36.9-0ubuntu0.20.04.1

3.36.9-0ubuntu0.20.04.2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-6",
            "binary_version":  "3.36.9-0ubuntu0.20.04.2"
        },
        {
            "binary_name":  "libmutter-6-0",
            "binary_version":  "3.36.9-0ubuntu0.20.04.2"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "3.36.9-0ubuntu0.20.04.2"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "3.36.9-0ubuntu0.20.04.2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"

Ubuntu:22.04:LTS

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

40.*

40.5-1ubuntu2

40.5-1ubuntu3

41.*

41.3-1ubuntu1

41.3-1ubuntu5

41.3-3ubuntu1

Other

42~beta-1ubuntu2

42.*

42.0-1ubuntu1

42.0-3ubuntu1

42.0-3ubuntu2

42.1-0ubuntu1

42.2-0ubuntu1

42.5-0ubuntu1

42.9-0ubuntu1

42.9-0ubuntu4

42.9-0ubuntu5

42.9-0ubuntu7

42.9-0ubuntu7.1

42.9-0ubuntu8

42.9-0ubuntu9

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-10",
            "binary_version":  "42.9-0ubuntu9"
        },
        {
            "binary_name":  "libmutter-10-0",
            "binary_version":  "42.9-0ubuntu9"
        },
        {
            "binary_name":  "libmutter-test-10",
            "binary_version":  "42.9-0ubuntu9"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "42.9-0ubuntu9"
        },
        {
            "binary_name":  "mutter-10-tests",
            "binary_version":  "42.9-0ubuntu9"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "42.9-0ubuntu9"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"

Ubuntu:24.04:LTS

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

45.*

45.0-3ubuntu3

45.0-3ubuntu4

45.2-1ubuntu1

45.2-3ubuntu1

45.3-1ubuntu1

46.*

46.0-1ubuntu6

46.0-1ubuntu7

46.0-1ubuntu9

46.2-1ubuntu0.24.04.1

46.2-1ubuntu0.24.04.2

46.2-1ubuntu0.24.04.4

46.2-1ubuntu0.24.04.5

46.2-1ubuntu0.24.04.6

46.2-1ubuntu0.24.04.7

46.2-1ubuntu0.24.04.8

46.2-1ubuntu0.24.04.9

46.2-1ubuntu0.24.04.10

46.2-1ubuntu0.24.04.12

46.2-1ubuntu0.24.04.13

46.2-1ubuntu0.24.04.14

46.2-1ubuntu0.24.04.15

46.2-1ubuntu0.24.04.16

46.2-1ubuntu0.24.04.18

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-14",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        },
        {
            "binary_name":  "libmutter-14-0",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        },
        {
            "binary_name":  "libmutter-test-14",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        },
        {
            "binary_name":  "mutter-14-tests",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        },
        {
            "binary_name":  "mutter-common-bin",
            "binary_version":  "46.2-1ubuntu0.24.04.18"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"

Ubuntu:26.04:LTS

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

49.*

49.0-2ubuntu5

49.0-2ubuntu6

49.1.1-2ubuntu1

49.2-1ubuntu1

Other

50~beta-2ubuntu3

50~beta-2ubuntu4

50.*

50.0-0ubuntu1

50.0-0ubuntu2

50.0-0ubuntu3

50.0-0ubuntu4

50.0-0ubuntu5

50.0-0ubuntu6

50.1-0ubuntu2

50.1-0ubuntu2.1

50.1-0ubuntu2.2

50.1-0ubuntu2.4

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-18",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "libmutter-18-0",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "libmutter-test-18",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "mutter-18-tests",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "mutter-common-bin",
            "binary_version":  "50.1-0ubuntu2.4"
        },
        {
            "binary_name":  "mutter-dev-bin",
            "binary_version":  "50.1-0ubuntu2.4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"

Ubuntu:26.10

mutter

Package

Name: mutter
Purl: pkg:deb/ubuntu/mutter?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

50.*

50.1-0ubuntu2

50.1-0ubuntu4

Other

51~alpha-0ubuntu2

51~beta-1ubuntu2

51.*

51.0-1ubuntu2

51.0-1ubuntu3

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "gir1.2-mutter-51",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "libmutter-51-0",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "libmutter-test-51",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "mutter",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "mutter-51-tests",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "mutter-common",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "mutter-common-bin",
            "binary_version":  "51.0-1ubuntu3"
        },
        {
            "binary_name":  "mutter-dev-bin",
            "binary_version":  "51.0-1ubuntu3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-108094.json"