Summary: client-triggered use-after-free of a wp_image_description_v1 wl_resource in the async ICC path

Requirements to exploit: A local unprivileged Wayland client that can connect to the compositor's Wayland socket ($XDG_RUNTIME_DIR/wayland-N), including Flatpak/Snap apps with Wayland access. The client binds wp_color_manager_v1, creates an ICC image description (create_icc_creator → set_icc_file → create), then destroys the wp_image_description_v1 resource while the asynchronous ICC file read is still in flight (create+destroy can be batched in one sendmsg). No elevated privileges beyond normal session client access are required.

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creator_icc_create / on_icc_create_bytes_read)

Version affected (maintainer): >= 47.0, < 51.0
Version fixed (maintainer): 51.0

Code-path note: The vulnerable pattern (unowned creator_icc->image_desc_resource used after destroy in on_icc_create_bytes_read) is present from mutter 49.rc through 50.4. It is not present in 47.x/48.x. Fixed code (refcounted MetaWaylandImageDescription; resource cleared on destroy) is in 50.5 and 51.0.

Patch available: Yes
Upstream fix: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
Key commit: 86141ab75b23 ("wayland/color-management: Fix lifetime of ICC image description"), merged 2026-09-11
Upstream report: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
Embargo: No
Acknowledgment: Calif.io, in collaboration with Anthropic