Quick answers
- Is CVE-2026-108094 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-108094 being exploited in the wild.
- How severe is CVE-2026-108094?
- High severity, with a CVSS score of 7.8, published 12 October 2026.
- Which products and versions are affected?
- Gnome Mutter 49.x through 50.4.
- Is there a fix for CVE-2026-108094?
- Yes: fixed in Mutter 50.5, 51.0. Until then: Do not run untrusted applications in the affected Wayland session. Limit Wayland socket access for untrusted clients. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-108094 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-108094?
- Check whether you run Gnome Mutter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Mutter 50.5, 51.0
Do not run untrusted applications in the affected Wayland session. Limit Wayland socket access for untrusted clients.
Technical details
A use-after-free vulnerability exists in mutter's async ICC file read path for Wayland color-management, where an attacker can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor dereferences the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. The vulnerability requires local code execution (ability to run a Wayland client) and affects mutter 49.x through 50.4; it is fixed in 50.5 and 51.0.
Affected products
- GNOME Mutter 49.x through 50.4
Timeline
- 2026-10-12: disclosed
- 2026-10-12: patched: Fixed in mutter 50.5 and 51.0 via merge request !5313