CVE-2026-88807: libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow

Q: Which systems are exposed to this issue?

X clients using libXrender versions before 0.9.13 are exposed when they connect to a malicious X server.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to operate or control the X server that an affected client connects to. The malicious server can send a crafted RenderQueryPictFormats reply to trigger the heap overflow and potentially inject code into the client.

Q: How can I determine whether a client is affected?

Check the libXrender version used by the client. Versions before 0.9.13 are affected.

Published Sep 21, 2026

Updated

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

Affected Software

1 affected component

libXrender<0.9.13

Event History

Sep 21, 2026

CVE Published

via MITRE·01:49 PM

Data Sourced

via MITRE·01:49 PM

DescriptionWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

X clients using libXrender versions before 0.9.13 are exposed when they connect to a malicious X server.

What does an attacker need to exploit the vulnerability?

An attacker needs to operate or control the X server that an affected client connects to. The malicious server can send a crafted RenderQueryPictFormats reply to trigger the heap overflow and potentially inject code into the client.

How can I determine whether a client is affected?

Check the libXrender version used by the client. Versions before 0.9.13 are affected.