Description

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-12T15:17:07.080Z",
  "pubdate": "2026-10-12T15:17:07.080Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the GNOME mutter compositor within the Wayland color-management ICC image-description handling logic.\nThe flaw stems from improper lifecycle management of the wp_image_description_v1 resource during asynchronous ICC file read operations.\nA local attacker operating a malicious Wayland client can trigger this memory corruption by destroying the resource while an asynchronous read process remains active.\nSuccessful exploitation results in the compositor performing operations on freed memory, which can lead to a denial-of-service via GNOME session termination or potentially arbitrary code execution within the compositor process.\nGiven that the compositor typically runs with elevated privileges or handles sensitive graphical data, this vulnerability poses a significant risk to system integrity and user confidentiality.\nExploitation is limited to local attackers capable of interfacing with the Wayland display server, making it a primary concern for multi-user environments or systems running untrusted applications.",
  "technicalDetails": "The vulnerability resides in the way mutter manages the lifecycle of wp_image_description_v1 resources during the asynchronous loading of ICC (International Color Consortium) profiles.\nThe root cause is a race condition between the client-driven destruction of a Wayland resource and the compositor’s internal asynchronous callback mechanism. Specifically, when a client requests an ICC image description, mutter initiates an asynchronous file read operation. If the client issues a destroy request for the wp_image_description_v1 object while this read operation is still pending, the associated wl_resource is freed by the Wayland display server handler.\nUpon the completion of the asynchronous I/O operation, the compositor attempts to reference the original wl_resource object to process the retrieved ICC data. Since the memory associated with this resource has already been deallocated, the compositor performs a use-after-free operation. This triggers a write operation into freed memory and, subsequently, a double-free or invalid pointer dereference when the compositor attempts to free a pointer derived from the corrupted memory state.\nThe exploitation flow proceeds as follows: 1) The attacker initiates an ICC profile load request via the Wayland protocol. 2) The attacker rapidly sends a destructor request for the wp_image_description_v1 resource. 3) The mutter compositor continues the asynchronous read operation while the object reference is now dangling. 4) The read operation callback executes, attempting to access the freed resource pointer. 5) The memory management subsystem, now operating on stale heap data, permits a write into the heap block previously occupied by the resource object.\nThis behavior can lead to heap grooming opportunities for an attacker. By controlling the contents of the memory that replaces the freed object, an attacker may influence the compositor's execution flow. This could allow for the corruption of function pointers or control data structures, potentially leading to arbitrary code execution within the security context of the compositor process. Even without successful payload execution, the resulting memory corruption is highly likely to induce a crash of the mutter process, causing an immediate denial-of-service for the entire GNOME session. The vulnerability does not require authentication beyond the ability to establish a Wayland connection to the compositor."
}