A use‐after‐free flaw in the mutter Wayland compositor’s ICC image‑description path allows a local attacker who can run a malicious Wayland client to destroy a wp_image_description_v1 resource while an asynchronous ICC file read remains in progress. When the read completes, the compositor will operate on freed memory, eventually causing a crash and potentially executing arbitrary code in its process context. The consequence is a session denial of service or privilege escalation for the compositor.

Red Hat Enterprise Linux 7, 8, 9 and 10 are affected because they ship the mutter component that contains the vulnerable ICC image‑description handling. No specific sub‑version constraints are listed in the CNA data.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, but the vulnerability is not recorded in CISA’s KEV catalog, suggesting no widely known exploitation yet. The likely attack vector is local: an attacker must run a malicious Wayland client in the same session and trigger a read of a crafted ICC file. Successful exploitation would crash the GNOME session and could lead to arbitrary code execution within the compositor process, posing a significant local privilege escalation risk.