A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wpimagedescriptionv1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wlresource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

Summary: client-triggered use-after-free of a wpimagedescriptionv1 wlresource in the async ICC path

Requirements to exploit: A local unprivileged Wayland client that can connect to the compositor's Wayland socket ($XDGRUNTIMEDIR/wayland-N), including Flatpak/Snap apps with Wayland access. The client binds wpcolormanagerv1, creates an ICC image description (createicccreator → seticcfile → create), then destroys the wpimagedescriptionv1 resource while the asynchronous ICC file read is still in flight (create+destroy can be batched in one sendmsg). No elevated privileges beyond normal session client access are required.

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creatoricccreate / onicccreatebytesread)

Version affected (maintainer): >= 47.0, < 51.0 Version fixed (maintainer): 51.0

Code-path note: The vulnerable pattern (unowned creatoricc->imagedescresource used after destroy in onicccreatebytesread) is present from mutter 49.rc through 50.4. It is not present in 47.x/48.x. Fixed code (refcounted MetaWaylandImageDescription; resource cleared on destroy) is in 50.5 and 51.0.

Patch available: Yes Upstream fix: https://gitlab.gnome.org/GNOME/mutter/-/mergerequests/5313 Key commit: 86141ab75b23 ("wayland/color-management: Fix lifetime of ICC image description"), merged 2026-09-11 Upstream report: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025 Embargo: No Acknowledgment: Calif.io, in collaboration with Anthropic