RLSA-2026:91267: Important: libXrender security update

Q: What would an attacker need to exploit this issue?

The CVSS vector indicates network reachability, no privileges required, and user interaction required. Exploitation is rated high complexity.

Q: What is the potential impact if exploitation succeeds?

The issue is described as code injection via a heap overflow in RenderQueryPictFormats. The CVSS vector indicates high confidentiality, integrity, and availability impact, with scope changed.

Published Oct 29, 2026

Updated

X.Org X11 libXrender runtime library

Security Fix(es):

libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/libxrender<0:0.9.10-8.el8_10

0:0.9.10-8.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/libXrender to a version that resolves this vulnerability.
Fixed in 0:0.9.10-8.el8_10

Event History

Oct 29, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-88807

Frequently Asked Questions

What would an attacker need to exploit this issue?