REDHAT-BUG-2549511: Use After Free

Q: Who can exploit this issue?

A local, unprivileged Wayland client that can connect to the compositor's Wayland socket can trigger it. This includes sandboxed Flatpak or Snap applications when they have Wayland access; no elevated privileges are required.

Q: What client behavior is required to trigger the vulnerable path?

The client must use wp_color_manager_v1 to create an ICC image description, then destroy the wp_image_description_v1 resource while its asynchronous ICC file read remains in progress. The create and destroy requests can be sent together in a single sendmsg call.

Q: Which Mutter releases are actually affected?

The vulnerable code path is present from mutter 49.rc through 50.4. Although the maintainer's broader affected range is listed as >= 47.0 and < 51.0, the described use-after-free pattern is not present in 47.x or 48.x; fixed code is in 50.5 and 51.0.

Q: What should be done if an affected version is installed?

Update Mutter to a release containing the fix, identified as 50.5 or 51.0. The fix refcounts MetaWaylandImageDescription and clears the resource when it is destroyed, preventing the asynchronous callback from using a destroyed resource.

Published Oct 12, 2026

Updated

Summary: client-triggered use-after-free of a wpimagedescriptionv1 wlresource in the async ICC path

Requirements to exploit: A local unprivileged Wayland client that can connect to the compositor's Wayland socket ($XDGRUNTIMEDIR/wayland-N), including Flatpak/Snap apps with Wayland access. The client binds wpcolormanagerv1, creates an ICC image description (createicccreator → seticcfile → create), then destroys the wpimagedescriptionv1 resource while the asynchronous ICC file read is still in flight (create+destroy can be batched in one sendmsg). No elevated privileges beyond normal session client access are required.

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creatoricccreate / onicccreatebytesread)

Version affected (maintainer): >= 47.0, < 51.0 Version fixed (maintainer): 51.0

Code-path note: The vulnerable pattern (unowned creatoricc->imagedescresource used after destroy in onicccreatebytesread) is present from mutter 49.rc through 50.4. It is not present in 47.x/48.x. Fixed code (refcounted MetaWaylandImageDescription; resource cleared on destroy) is in 50.5 and 51.0.

Patch available: Yes Upstream fix: https://gitlab.gnome.org/GNOME/mutter/-/mergerequests/5313 Key commit: 86141ab75b23 ("wayland/color-management: Fix lifetime of ICC image description"), merged 2026-09-11 Upstream report: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025 Embargo: No Acknowledgment: Calif.io, in collaboration with Anthropic

Affected Software

1 affected component

Gnome Mutter>=49.rc<=50.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mutter to a version that resolves this vulnerability.
Fixed in 50.5

Event History

Oct 12, 2026

Data Sourced

via Red Hat·10:36 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A local, unprivileged Wayland client that can connect to the compositor's Wayland socket can trigger it. This includes sandboxed Flatpak or Snap applications when they have Wayland access; no elevated privileges are required.

What client behavior is required to trigger the vulnerable path?

The client must use wp_color_manager_v1 to create an ICC image description, then destroy the wp_image_description_v1 resource while its asynchronous ICC file read remains in progress. The create and destroy requests can be sent together in a single sendmsg call.

Which Mutter releases are actually affected?

The vulnerable code path is present from mutter 49.rc through 50.4. Although the maintainer's broader affected range is listed as >= 47.0 and < 51.0, the described use-after-free pattern is not present in 47.x or 48.x; fixed code is in 50.5 and 51.0.

What should be done if an affected version is installed?

Update Mutter to a release containing the fix, identified as 50.5 or 51.0. The fix refcounts MetaWaylandImageDescription and clears the resource when it is destroyed, preventing the asynchronous callback from using a destroyed resource.

REDHAT-BUG-2549511: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What client behavior is required to trigger the vulnerable path?

Which Mutter releases are actually affected?

What should be done if an affected version is installed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What client behavior is required to trigger the vulnerable path?

Which Mutter releases are actually affected?

What should be done if an affected version is installed?