{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agnomemutter/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gnome:mutter:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-108094"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mutter"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GNOME"],"content_html":"\u003cp\u003eA high-severity use-after-free (UAF) vulnerability, tracked as CVE-2026-108094, exists in the GNOME mutter compositor. The flaw is located within the Wayland color-management ICC (International Color Consortium) image-description handling code. An attacker with local access can execute a malicious Wayland client to interact with the compositor. By specifically destroying a \u003ccode\u003ewp_image_description_v1\u003c/code\u003e resource at the precise moment an asynchronous ICC file read is in progress, the attacker causes the compositor to continue operations using a stale pointer to freed memory.\u003c/p\u003e\n\u003cp\u003eUpon the completion of the ICC file read, the compositor attempts to access the already freed \u003ccode\u003ewl_resource\u003c/code\u003e. This results in a memory corruption scenario where the compositor writes to or frees data based on invalid memory pointers. This vulnerability is significant because it allows a local, unprivileged user to destabilize the graphical session or potentially gain arbitrary code execution context within the compositor process, which often operates with elevated privileges in Linux desktop environments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability is significant for multi-user Linux systems or environments where local users may be untrusted. Successful exploitation causes a complete crash of the GNOME session for the targeted user. In more critical scenarios, the memory corruption can be weaponized to achieve arbitrary code execution within the mutter process. This would effectively grant the attacker the ability to intercept inputs, bypass graphical sandboxing, or escalate privileges within the local user session.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification and patching of the GNOME mutter compositor across all Linux endpoints utilizing the GNOME desktop environment.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-provided patch for mutter addressing CVE-2026-108094 as soon as it becomes available through the distribution's package management system.\u003c/li\u003e\n\u003cli\u003eImplement restrictive local access controls to limit the execution of untrusted binaries or scripts that could function as malicious Wayland clients.\u003c/li\u003e\n\u003cli\u003eMonitor local system logs for frequent crashes of the \u003ccode\u003egnome-shell\u003c/code\u003e or \u003ccode\u003emutter\u003c/code\u003e processes, which may indicate attempted exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T15:43:49Z","date_published":"2026-10-12T15:43:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mutter-uaf/","summary":"A use-after-free vulnerability in the GNOME mutter compositor allows local attackers to trigger crashes or arbitrary code execution via a malicious Wayland client manipulating wp_image_description_v1 resources.","title":"Use-After-Free Vulnerability in GNOME Mutter Wayland ICC Path","url":"https://feed.craftedsignal.io/briefs/2026-10-mutter-uaf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gnome:mutter:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}