ZDI-26-905: X.Org Server libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Nov 10, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-88807.

Event History

Nov 10, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What must an attacker do to exploit this issue?

The target must connect to a malicious X11 server. Exploitation requires user interaction and can result in arbitrary code execution on the affected X.Org Server installation.

Who is most exposed to this vulnerability?

Systems running affected X.Org Server installations are exposed when their users can be induced to connect to an attacker-controlled X11 server. The provided information does not identify affected versions or configurations.

ZDI-26-905: X.Org Server libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is most exposed to this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is most exposed to this vulnerability?