VDB
CVE-2026-88807
CVE-2026-88807
PUBLISHED
CVSS 8.9 HIGH
libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
Reported by suse · Published September 21, 2026
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| libXrender-debugsource | errata.rockylinux.org | 0:0.9.11-8.el10_2.1.x86_64, 0:0.9.11-8.el10_2.1.s390x, 0:0.9.11-8.el10_2.1.ppc64le, 0:0.9.11-8.el10_2.1.aarch64, 0:0.9.10-16.el9_8.2.x86_64, 0:0.9.10-16.el9_8.2.s390x, 0:0.9.10-16.el9_8.2.ppc64le, 0:0.9.10-16.el9_8.2.i686, 0:0.9.10-16.el9_8.2.aarch64, 0:0.9.10-8.el8_10.x86_64, 0:0.9.10-8.el8_10.i686 |
| libXrender | errata.rockylinux.org | 0:0.9.11-8.el10_2.1.x86_64, 0:0.9.11-8.el10_2.1.src, 0:0.9.11-8.el10_2.1.ppc64le, 0:0.9.11-8.el10_2.1.aarch64, 0:0.9.10-16.el9_8.2.x86_64, 0:0.9.10-16.el9_8.2.src, 0:0.9.10-16.el9_8.2.s390x, 0:0.9.10-16.el9_8.2.ppc64le, 0:0.9.10-16.el9_8.2.i686, 0:0.9.10-16.el9_8.2.aarch64, 0:0.9.10-8.el8_10.x86_64, 0:0.9.10-8.el8_10.src, 0:0.9.10-8.el8_10.i686, 0:0.9.10-8.el8_10.aarch64 |
| libXrender-devel | errata.rockylinux.org | 0:0.9.11-8.el10_2.1.x86_64, 0:0.9.11-8.el10_2.1.s390x, 0:0.9.11-8.el10_2.1.ppc64le, 0:0.9.11-8.el10_2.1.aarch64, 0:0.9.10-16.el9_8.2.x86_64, 0:0.9.10-16.el9_8.2.s390x, 0:0.9.10-16.el9_8.2.ppc64le, 0:0.9.10-16.el9_8.2.i686, 0:0.9.10-16.el9_8.2.aarch64, 0:0.9.10-8.el8_10.x86_64, 0:0.9.10-8.el8_10.i686 |
| libXrender-debuginfo | errata.rockylinux.org | 0:0.9.11-8.el10_2.1.x86_64, 0:0.9.11-8.el10_2.1.ppc64le, 0:0.9.11-8.el10_2.1.aarch64, 0:0.9.10-16.el9_8.2.x86_64, 0:0.9.10-16.el9_8.2.s390x, 0:0.9.10-16.el9_8.2.ppc64le, 0:0.9.10-16.el9_8.2.i686, 0:0.9.10-16.el9_8.2.aarch64, 0:0.9.10-8.el8_10.x86_64, 0:0.9.10-8.el8_10.i686, 0:0.9.10-8.el8_10.aarch64 |
| libXrender | Amazon Linux | 0.9.11-6.amzn2023.0.2, 0.9.10-1.amzn2.0.3 |
| libXrender-devel | Amazon Linux | 0.9.11-6.amzn2023.0.2, 0.9.10-1.amzn2.0.3 |
| libxrender | Alpine | 0.9.13-r0 |
| libXrender | X.org | 0.9.13 |
Risk scores
CVSS 4.0
8.9
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| X.org | libXrender | 0 |
| X.org | libXrender | |
| amazon:2023 | libXrender | 0 |
| amazon:2 | libXrender-devel | 0 |
| amazon:2023 | libXrender-devel | 0 |
| alpine | libxrender | 0 |
| amazon:2 | libXrender | 0 |
| X.org | libXrender | 0 |
| x.org | libxrender | 0 |
Timeline
- Sep 21, 2026 CVE Published
- Sep 21, 2026 Coalition ESS Score
- Sep 22, 2026 EPSS Score (12 in total, the first dated here)
- Sep 22, 2026 CVE Updated
- Nov 3, 2026 Distribution Patch (3 in total, the first dated here)
- Nov 4, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-88807
vulnetix vdb fixes CVE-2026-88807Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-88807/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart