CVE-2006-1526
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows...
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
- Record
CVE-2006-1526- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
- Record
CVE-2006-1526- Updated
- 2026-11-02
EUVDEUVD-2006-1530 No score
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
- Record
EUVD-2006-1530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3hm-p5jw-xp4h No score
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows...
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
- Record
GHSA-h3hm-p5jw-xp4h- Updated
- 2026-11-02
OSV No score
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
- Record
CVE-2006-1526- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-1526 No score
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
- Record
DEBIAN-CVE-2006-1526- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xorg-serverDebian:12 |
before 1:1.0.2-8 | 1:1.0.2-8 |
xorg-serverDebian:13 |
before 1:1.0.2-8 | 1:1.0.2-8 |
xorg-serverDebian:14 |
before 1:1.0.2-8 | 1:1.0.2-8 |
xorg-x11Red Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLURed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XdmxRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XnestRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XvfbRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libsRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-deprecated-libs-develRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-develRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-docRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-font-utilsRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-libsRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-sdkRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-toolsRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-twmRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xauthRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xdmRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xfsRed Hat:enterprise_linux:4::as |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11Red Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLURed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XdmxRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XnestRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XvfbRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libsRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libs-develRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-develRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-docRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-font-utilsRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-libsRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-sdkRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-toolsRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-twmRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xauthRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xdmRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xfsRed Hat:enterprise_linux:4::desktop |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11Red Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLURed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XdmxRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XnestRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XvfbRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libsRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libs-develRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-develRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-docRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-font-utilsRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-libsRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-sdkRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-toolsRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-twmRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xauthRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xdmRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xfsRed Hat:enterprise_linux:4::es |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11Red Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-Mesa-libGLURed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XdmxRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XnestRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-XvfbRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libsRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-deprecated-libs-develRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-develRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-docRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-font-utilsRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-libsRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-sdkRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-toolsRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-twmRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xauthRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xdmRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
xorg-x11-xfsRed Hat:enterprise_linux:4::ws |
before 0:6.8.2-1.EL.13.25.1 | 0:6.8.2-1.EL.13.25.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1526 is a low vulnerability (CVSS 2.1) in X.org X11r6, published May 2, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in xorg-server 1:1.0.2-8.
References
redhat.com/support/errata/RHSA-2006-0451.html
secunia.com/advisories/19921
exchange.xforce.ibmcloud.com/vulnerabilities/26200
mandriva.com/security/advisories?name=MDKSA-2006:081
Show 29 moreShow less
vupen.com/english/advisories/2006/1617
novell.com/linux/security/advisories/2006_05_03.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9929
securityfocus.com/bid/17795
sunsolve.sun.com/search/document.do?assetkey=1-26-102339-1
kb.cert.org/vuls/id/633257
securitytracker.com/id?1016018
gentoo.org/security/en/glsa/glsa-200605-02.xml
openbsd.org/errata38.html
trustix.org/errata/2006/0024
bugs.freedesktop.org/show_bug.cgi?id=6642
usn.ubuntu.com/280-1
lists.freedesktop.org/archives/xorg/2006-May/015136.html
nvd.nist.gov/vuln/detail/CVE-2006-1526
github.com/advisories/GHSA-h3hm-p5jw-xp4h
security-tracker.debian.org/tracker/CVE-2006-1526
access.redhat.com/errata/RHSA-2006:0451
bugzilla.redhat.com/show_bug.cgi?id=189801
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0451.json
cve.org/CVERecord?id=CVE-2006-1526