GNOME Mutter EUVD-2026-97472

Requires: (1) local access with the ability to run a Wayland client against the target compositor (an authenticated, possibly unprivileged, local session - consistent with PR:L); (2) the session must be running mutter as a Wayland compositor (not the X11 session); and (3) the Wayland color-management protocol path must be reachable, i.e. the compositor exposes wp_image_description_v1 and performs asynchronous ICC profile file reads. The specific trigger is destroying the wp_image_description_v1 resource while its asynchronous ICC file read is still in progress - a timing-dependent race. LIMITING FACTORS that reduce realistic risk: exploitation is local-only (not remote/network), requires an existing foothold on the machine, depends on winning a race window (which hampers reliable code execution and may often yield only a session crash), and does not apply to X11-only sessions or builds lacking the Wayland color-management/ICC code path.

This is a genuinely credible local privilege/code-execution risk but NOT an urgent internet-facing emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: the attacker needs local access and the ability to run a Wayland client (PR:L, a logged-in/unprivileged local user), no user interaction, and achieves high confidentiality/integrity/availability impact by corrupting memory inside the compositor process. CWE-416 (use-after-free) with a controllable free-of-derived-pointer is a classic, exploitable corruption primitive, which supports the I:H/C:H ratings beyond mere denial of service. However, exploitation signals are weak: there is NO CISA KEV listing, NO EPSS score provided, and NO public exploit referenced - so this is 'no public exploit identified at time of analysis.' The race-condition nature (free the wp_image_description_v1 resource while an async ICC file read is still in flight) raises real-world complexity despite the AC:L rating; reliable code execution requires winning a timing window and grooming the compositor heap, so weaponization is non-trivial. Net: treat as a standard-priority local DoS/LPE-class desktop vulnerability - patch in normal cycles, prioritize multi-user and shared/kiosk GNOME systems - rather than a drop-everything remote threat. Key missing data to note explicitly: no EPSS, no KEV, no POC, and both references are placeholder Red Hat tracking pages (access.redhat.com CVE page and Bugzilla) with no fixed-version or advisory detail confirmed in the input.

On a multi-user or shared GNOME-on-Wayland workstation, an unprivileged local user runs a malicious Wayland client that creates a wp_image_description_v1 color-management resource, triggers an asynchronous ICC profile file read, then destroys the resource before the read completes. When the read callback fires it operates on the freed wl_resource and frees a derived pointer, crashing the GNOME session or - with heap grooming to control the freed memory - executing attacker-controlled code inside the mutter compositor process. No public exploit code is identified at time of analysis, and the async race makes reliable RCE harder than the AC:L rating alone suggests.