High severity · published Sep 21, 2026
CVE-2026-88807
libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
8.9
CVSS
0.3%
EPSS
No
On KEV
Description
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libXrender · X.org
before 0.9.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-88807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-88807
gitlab.freedesktop.org
https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19
More from libXrender
9.8
CVE-2016-7950
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths
9.8
CVE-2016-7949
Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write…