Loading vulnerability…
Heap buffer overflow in libXrender RenderQueryPictFormats
CVE-2026-88807 is a heap-based buffer overflow in the RenderQueryPictFormats functionality of libXrender versions before 0.9.13. A malicious X server can supply a picture-format query reply whose numSubpixels count exceeds numScreens. The client allocates screen structures using numScreens but processes the excessive subpixel count, causing out-of-bounds writes to screen->subpixel. This memory corruption can allow code injection and execution in an attached X client.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the affected X client through arbitrary code execution with the client's privileges. Heap corruption can also crash the application. The extent of compromise depends on the permissions and resources available to the client process; privilege escalation is not an inherent outcome.
If you can’t patch tonight, do this now.
Until patched, avoid connecting affected X clients to untrusted or potentially compromised X servers. Separate privileged functionality from graphical interfaces to limit the consequences of client compromise.
Patch, then assume compromise.
Upgrade libXrender to version 0.9.13 or later, or install the distribution's security update containing the backported fix. Update affected runtime and related packages as directed by the vendor. Distribution packages with upstream version numbers below 0.9.13 may contain the fix, so verify their status against the applicable security advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.