CVE-2026-88807
Received Received - Intake

Heap Overflow in libXrender Before 0.9.13

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: SUSE

Description
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-88807
EUVD
EUVD-2026-83916

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap overflow vulnerability in libXrender before version 0.9.13. It occurs in the RenderQueryPictFormats function and could allow a malicious X server to inject code into connected X clients.

Detection Guidance

Detection requires checking the version of libXrender. If your system uses a version before 0.9.13, it may be vulnerable. Run: 'rpm -q libXrender' on RPM-based systems or 'dpkg -l libxrender1' on Debian-based systems to check the installed version.

Impact Analysis

An attacker exploiting this could execute arbitrary code on your system if you are running a vulnerable version of libXrender. This could lead to full system compromise, data theft, or further network attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Update libXrender to version 0.9.13 or later immediately. On RPM-based systems, use 'zypper update libXrender' or 'yum update libXrender'. On Debian-based systems, use 'apt-get install --only-upgrade libxrender1'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart