Your message dated Wed, 14 Oct 2026 23:42:00 +0200
with message-id
<CAAajCMb+jHdqZbhTy-JG8x=ureekyvompngcjjya7e4cfns...@mail.gmail.com>
and subject line Re: Bug#1150932: mutter: CVE-2026-108094
has caused the Debian Bug report #1150932,
regarding mutter: CVE-2026-108094
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150932: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150932
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mutter
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for mutter.
CVE-2026-108094[0]:
| A use-after-free flaw was found in mutter in the Wayland color-
| management ICC image-description path. A local attacker who can run
| a malicious Wayland client can destroy a wp_image_description_v1
| resource while an asynchronous ICC file read is still in progress.
| When the read completes, the compositor uses the freed wl_resource,
| writes into freed memory, and frees a pointer derived from that
| memory. This can crash the GNOME session and may allow arbitrary
| code execution within the compositor process.
https://bugzilla.redhat.com/show_bug.cgi?id=2549511
https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-108094
https://www.cve.org/CVERecord?id=CVE-2026-108094
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Version: 50.5-1
On Wed, Oct 14, 2026 at 11:17 PM Moritz Mühlenhoff <[email protected]> wrote:
> CVE-2026-108094[0]:
> | A use-after-free flaw was found in mutter in the Wayland color-
> | management ICC image-description path. A local attacker who can run
> | a malicious Wayland client can destroy a wp_image_description_v1
> | resource while an asynchronous ICC file read is still in progress.
> | When the read completes, the compositor uses the freed wl_resource,
> | writes into freed memory, and frees a pointer derived from that
> | memory. This can crash the GNOME session and may allow arbitrary
> | code execution within the compositor process.
>
> https://bugzilla.redhat.com/show_bug.cgi?id=2549511
It looks like this issue was already fixed in upstream 50.5. I haven't
checked whether Debian 13 is affected. The Red Hat bug suggests that
mutter 48 might not be affected but the wording is confusing.
Thank you,
Jeremy Bícha
--- End Message ---
