CVE-2026-88807: libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
Other sources
libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.9.13-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
X clients using libXrender versions before 0.9.13 are exposed when they connect to a malicious X server.
What does an attacker need to exploit the vulnerability?
An attacker needs to operate or control the X server that an affected client connects to. The malicious server can send a crafted RenderQueryPictFormats reply to trigger the heap overflow and potentially inject code into the client.
How can I determine whether a client is affected?
Check the libXrender version used by the client. Versions before 0.9.13 are affected.