X.Org libXrender reply overflow allows remote code execution
Original title: ZDI-26-905: X.Org Server libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability
Exploitation needs a connection to a malicious X11 server; ZDI rates CVE-2026-88807 at CVSS 8.8.
ZDI published ZDI-26-905, a heap-based buffer overflow in the libXrender RenderQueryPictFormats reply path of X.Org Server. Remote attackers can run arbitrary code if the target connects to a malicious X11 server. ZDI assigned CVE-2026-88807 and a CVSS score of 8.8. No fixed version or known exploitation is stated.
- Tracked as ZDI-26-905 and CVE-2026-88807.
- The flaw is in the RenderQueryPictFormats reply handling.
- The target must connect to a malicious X11 server.
- ZDI assigned a CVSS rating of 8.8.
Impact: Remote arbitrary code execution after connecting to a malicious X11 server
| Product | Affected |
|---|---|
| X.Org Server libXrender | — |
- 1.Do not connect X clients to untrusted X11 servers.
- CVEs
- CVE-2026-88807
- Vendors
- X.Org
- Products
- X.Org ServerlibXrender
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88807 | Heap Overflow in libXrender via Malicious X Server | 8.9 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of X. Org Server. User interaction is required to exploit this vulnerability in that the target must connect to a malicious X11 server.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.