Is CVE-2026-88807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88807 being exploited in the wild.

How severe is CVE-2026-88807?

Informational severity, published 21 September 2026.

Which products and versions are affected?

X.Org Foundation libXrender before 0.9.13.

Is there a fix for CVE-2026-88807?

A patch was published on 2026-09-18: Fix merged in libXrender repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88807 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-88807?

Check whether you run X.Org Foundation libXrender at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88807: libXrender heap overflow in RenderQueryPictFormats

CVE-2026-88807 · Severity: info · Published 2026-09-21

libXrender is an X Window System library that handles rendering operations for graphical applications. A heap overflow vulnerability in the RenderQueryPictFormats function allows a malicious X server to write beyond allocated memory, potentially enabling code injection into X client processes that connect to it. This could give an attacker complete control over any X applications running on a system.

Vendors: X.Org Foundation.

Quick answers

Is CVE-2026-88807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88807 being exploited in the wild.
How severe is CVE-2026-88807?: Informational severity, published 21 September 2026.
Which products and versions are affected?: X.Org Foundation libXrender before 0.9.13.
Is there a fix for CVE-2026-88807?: A patch was published on 2026-09-18: Fix merged in libXrender repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88807 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-88807?: Check whether you run X.Org Foundation libXrender at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability occurs in RenderQueryPictFormats when a malicious X server sends a response with a numSubpixels count greater than numScreens, causing out-of-bounds writes to the screen->subpixel buffer allocated based on the actual screen count. The attack requires a compromised or attacker-controlled X server to which a client connects, enabling arbitrary code execution within the context of the client application.

Affected products

X.Org Foundation libXrender before 0.9.13

Timeline

2026-09-21: disclosed
2026-09-18: patched: Fix merged in libXrender repository

References

https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.