{"id":"CVE-2026-88807","aliases":["ALPINE-CVE-2026-88807","ALSA-2026:91003","ALSA-2026:91057","ALSA-2026:91267","AZL-103391","BELL-CVE-2026-88807","DEBIAN-CVE-2026-88807","EUVD-2026-83916","GHSA-52cp-fjgx-xr28","MGASA-2026-0543","OESA-2026-4476","OESA-2026-4477","OESA-2026-4478","OESA-2026-4479","RLSA-2026:91003","RLSA-2026:91057","RLSA-2026:91267","ROOT-OS-DEBIAN-12-CVE-2026-88807","ROOT-OS-DEBIAN-13-CVE-2026-88807","SUSE-SU-2026:23886-1","SUSE-SU-2026:23900-1","SUSE-SU-2026:4395-1","SUSE-SU-2026:4397-1","UBUNTU-CVE-2026-88807","openSUSE-SU-2026:11834-1","openSUSE-SU-2026:21909-1"],"status":"published","title":"libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00263,"percentile":0.18224,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-09-21T00:00:00Z","modified":"2026-11-04T07:16:14Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libxrender","fixed_in":["0.9.13-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libXrender","fixed_in":["0.9.11-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libXrender-devel","fixed_in":["0.9.11-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libXrender","fixed_in":["0.9.10-16.el9_8.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libXrender-devel","fixed_in":["0.9.10-16.el9_8.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libXrender","fixed_in":["0.9.10-8.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libXrender-devel","fixed_in":["0.9.10-8.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libXrender","fixed_in":["0.9.13-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libxrender","fixed_in":["0.9.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libxrender","fixed_in":["0.9.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxrender","fixed_in":["0.9.13-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxrender","fixed_in":["1:0.9.13-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libXrender","fixed_in":["0.9.10-13.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libXrender","fixed_in":["0.9.11-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libXrender","fixed_in":["0.9.11-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libXrender","fixed_in":["0.9.11-2.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libXrender","fixed_in":["0:0.9.11-8.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libXrender","fixed_in":["0:0.9.10-16.el9_8.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libXrender","fixed_in":["0:0.9.10-8.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libxrender","fixed_in":["1:0.9.10-1.1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libxrender","fixed_in":["1:0.9.10-1.1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"libxrender","fixed_in":["1:0.9.12-1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-libxrender","fixed_in":["1:0.9.12-1.aikido.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libXrender","fixed_in":["0.9.11-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXrender","fixed_in":["0.9.11-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXrender","fixed_in":["0.9.11-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libXrender","fixed_in":["0.9.8-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libXrender","fixed_in":["0.9.8-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libXrender","fixed_in":["0.9.10-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libXrender","fixed_in":["0.9.12-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libXrender","fixed_in":["0.9.11-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libXrender-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-16.el9_8.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libXrender-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-16.el9_8.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-8.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libXrender-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-8.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.11-r0"},{"fixed":"0.9.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.12-r0"},{"fixed":"0.9.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.11-r0"},{"fixed":"0.9.13-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.10-1.1","1:0.9.12-1","1:0.9.13-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.12-1","1:0.9.13-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.13-1"}]}],"versions":["1:0.9.12-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libxtst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-2.2.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:10","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-2.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:10","package":"libxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-2.2.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-13.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-8.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.10-16.el9_8.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.10-8.el8_10"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.10-1.1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.10-1.1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.12-1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.9.12-1.aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.8-1","1:0.9.8-1build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.9-0ubuntu1","1:0.9.9-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.10-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.10-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.10-1build2","1:0.9.10-1build3","1:0.9.10-1build4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.10-1.1","1:0.9.10-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.12-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.9.12-1","1:0.9.12-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libXrender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-160000.3.1"}]}]}],"products":[{"vendor":"x.org","product":"libxrender"}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19","tags":["patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-52cp-fjgx-xr28"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-88807","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91003","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88807","tags":["report"]},{"url":"https://bugzilla.redhat.com/2537924","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-91003.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91057","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-91057.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91267","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-91267.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-88807","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88807.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libxrender","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88807","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0543.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36533","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/16/37","tags":["web"]},{"url":"https://lists.x.org/archives/xorg-announce/2026-October/thread.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4476","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4477","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4478","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4479","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:91003","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537924","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:91057","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:91267","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623886-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280911","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88807","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623900-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264395-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264397-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88807","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-88807","title":"libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T13:49:21.327Z","modified":"2026-09-22T03:55:46.845Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-83916","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T13:49:21Z","modified":"2026-09-22T03:55:46Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T17:28:03.79222Z"}],"ghsa":[{"id":"GHSA-52cp-fjgx-xr28","title":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious...","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T15:32:04Z","modified":"2026-09-21T15:32:08Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:12:15.376121Z"}],"nvd":[{"id":"CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T14:17:22.41Z","modified":"2026-09-22T19:40:05.87Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"ALPINE-CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T14:17:22.41Z","modified":"2026-10-18T10:30:02.697780057Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-88807","title":"libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T13:49:21.327Z","modified":"2026-10-29T15:27:05.954210089Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T14:17:22.41Z","modified":"2026-11-01T05:00:08.574153506Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OESA-2026-4476","title":"libXrender security update","description":"X.Org X11 libXrender runtime library\r\n\r\nSecurity Fix(es):\n\nA heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.(CVE-2026-88807)","status":"published","published":"2026-10-22T14:35:36Z","modified":"2026-10-22T14:45:07.186477637Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4477","title":"libXrender security update","description":"X.Org X11 libXrender runtime library\r\n\r\nSecurity Fix(es):\n\nA heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.(CVE-2026-88807)","status":"published","published":"2026-10-22T14:35:36Z","modified":"2026-10-22T14:45:03.548008394Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4478","title":"libXrender security update","description":"X.Org X11 libXrender runtime library\r\n\r\nSecurity Fix(es):\n\nA heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.(CVE-2026-88807)","status":"published","published":"2026-10-22T14:35:37Z","modified":"2026-10-22T14:45:03.529544597Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4479","title":"libXrender security update","description":"X.Org X11 libXrender runtime library\r\n\r\nSecurity Fix(es):\n\nA heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.(CVE-2026-88807)","status":"published","published":"2026-10-22T14:35:37Z","modified":"2026-10-22T14:45:07.183672979Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RLSA-2026:91003","title":"Important: libXrender security update","description":"X.Org X11 libXrender runtime library\n\nSecurity Fix(es):\n\n* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:08:23.381701Z","modified":"2026-10-29T12:30:04.198299129Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:91057","title":"Important: libXrender security update","description":"X.Org X11 libXrender runtime library\n\nSecurity Fix(es):\n\n* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:03.143702488Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:91267","title":"Important: libXrender security update","description":"X.Org X11 libXrender runtime library\n\nSecurity Fix(es):\n\n* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:01:16.697685Z","modified":"2026-10-29T12:30:03.18736365Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T14:17:00Z","modified":"2026-10-17T13:01:15.885083434Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:91003","title":"Important: libXrender security update","description":"X.Org X11 libXrender runtime library  \n\nSecurity Fix(es):  \n\n  * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:31:03.037180057Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:91057","title":"Important: libXrender security update","description":"X.Org X11 libXrender runtime library  \n\nSecurity Fix(es):  \n\n  * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T15:15:02.820157477Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:91267","title":"Important: libXrender security update","description":"X.Org X11 libXrender runtime library  \n\nSecurity Fix(es):  \n\n  * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:02:25.45924232Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-103391","title":"CVE-2026-88807 affecting package libXrender for versions less than 0.9.13-1","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.","status":"published","published":"2026-09-21T14:17:22Z","modified":"2026-11-02T14:15:41.584839765Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"BELL-CVE-2026-88807","status":"published","published":"2026-09-24T06:04:15.25081Z","modified":"2026-11-04T07:16:14.255386068Z","updated_at":"2026-11-04T07:31:49.594962Z"},{"id":"MGASA-2026-0543","title":"Updated libxtst, libxrender, libxi packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nlibXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow.\n(CVE-2026-109089)\nlibXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow.\n(CVE-2026-109090)\nOut-of-bounds read in libXrender's XRenderQueryFormat reply parser.\n(CVE-2026-88807)\nlibXtst RECORD EnableContext Reply Endless Loop. (CVE-2026-109088)\n","status":"published","published":"2026-10-26T15:28:20Z","modified":"2026-10-26T15:43:21.640113348Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11834-1","title":"libXrender-devel-0.9.12-2.1 on GA media","description":"These are all security issues fixed in the libXrender-devel-0.9.12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T18:23:09.51059329Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21909-1","title":"Security update for libXrender","description":"This update for libXrender fixes the following issue:\n\n- CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow (bsc#1280911).\n","status":"published","published":"2026-09-22T11:13:28Z","modified":"2026-09-25T18:23:12.445138022Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-88807","title":"CVE-2026-88807 in libxrender - Patched by Root","description":"Root has patched CVE-2026-88807 in the libxrender package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-25T06:56:38Z","modified":"2026-09-25T07:15:21.707684061Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-88807","title":"CVE-2026-88807 in libxrender - Patched by Root","description":"Root has patched CVE-2026-88807 in the libxrender package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-28T13:41:56Z","modified":"2026-09-28T14:15:03.237111816Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23886-1","title":"Security update for libXrender","description":"This update for libXrender fixes the following issue:\n\n- CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow (bsc#1280911).\n","status":"published","published":"2026-09-22T11:12:56Z","modified":"2026-09-30T18:23:11.192598045Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23900-1","title":"Security update for libXrender","description":"This update for libXrender fixes the following issue:\n\n- CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow (bsc#1280911).\n","status":"published","published":"2026-09-22T11:12:56Z","modified":"2026-09-30T18:23:12.126766389Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4395-1","title":"Security update for libXrender","description":"This update for libXrender fixes the following issue:\n\n- CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow (bsc#1280911).\n","status":"published","published":"2026-09-29T13:33:37Z","modified":"2026-09-30T12:00:04.107803901Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4397-1","title":"Security update for libXrender","description":"This update for libXrender fixes the following issue:\n\n- CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow (bsc#1280911).\n","status":"published","published":"2026-09-29T13:36:43Z","modified":"2026-09-30T12:00:04.602963985Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}