X.Org libXrender reply overflow allows remote code execution
Exploitation needs a connection to a malicious X11 server; ZDI rates CVE-2026-88807 at CVSS 8.8.
52
CVE-2026-88807
Heap Overflow in libXrender via Malicious X Server
- CVSS 4.0
- 8.9 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-88807 is a heap overflow vulnerability in the libXrender library, specifically within the RenderQueryPictFormats function. The flaw is triggered when an X client connects to a malicious X server, which can exploit the overflow to inject and execute arbitrary code within the client process. This allows the attacker to potentially compromise the client machine. The vulnerability affects libXrender versions prior to 0.9.13. As of this report, there are no known public exploits or active attacks in the wild.
What to do: Update libXrender to version 0.9.13 or later immediately. If immediate patching is not feasible, restrict X server access to trusted users and systems only.
| Product | Affected |
|---|---|
| X.Org libXrender | before 0.9.13 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
- Weakness
- CWE-122
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X