Skip to main content

libXrender CVE-2026-88807

| EUVDEUVD-2026-83916 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-09-21 suse GHSA-52cp-fjgx-xr28
Buffer Overflow Heap Overflow Red Hat Suse X Org Libxrender
8.9
CVSS 4.0 · Vendor: suse
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim client to malicious X server
  2. Delivery
    Client issues RenderQueryPictFormats
  3. Exploit
    Server returns crafted reply
  4. Execution
    Heap overflow in libXrender client
  5. Impact
    Inject and execute code in client process

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to run an X11 client (linked against libXrender < 0.9.13) that connects to an attacker-controlled or compromised X SERVER - this is a reverse-direction attack where the server compromises the client, not the usual client-attacks-server model. Realistic exposure is limited to setups that connect clients to untrusted displays: SSH X11 forwarding to an untrusted/compromised host, remote DISPLAY connections, or a hijacked X server. It does NOT affect clients talking only to a local trusted X server. Limiting factors: the victim must actively initiate the connection (UI:A), and heap-overflow exploitation is non-trivial (AC:H). No client authentication or elevated privileges are needed on the attacker side beyond controlling the X server the client attaches to.
Impact

This is a genuine high-severity issue but with an unusual and limiting threat model that tempers real-world risk. The vendor CVSS 4.0 score of 8.9 reflects full CIA compromise (VC:H/VI:H/VA:H) via code injection, and AC:H already captures the difficulty of heap-overflow exploitation. Critically, this is a REVERSE-DIRECTION attack: the malicious party is the X SERVER, and the victim is the X CLIENT running libXrender - the opposite of the usual client-attacks-server model. UI:A (active user interaction) is correct because a victim must actively connect its client to an attacker-controlled or compromised X server (e.g. SSH X11 forwarding to an untrusted host, or a hijacked remote X display). No EPSS score, no CISA KEV listing, and no public POC are present in the intelligence - so despite the high CVSS, there is no evidence of widespread or automated exploitation. The 4.0 vector sets subsequent-system impact (SC/SI/SA:H), but the described impact is code injection confined to the client process, which I assess as no scope change. Net: a real patch-worthy vulnerability for environments using X11 forwarding to untrusted servers, but not an emergency for typical trusted-display desktop setups.
Exploit ScenarioDerived

A user connects an X11 client (via SSH X11 forwarding or a remote DISPLAY) to a server the attacker controls or has compromised. When the client queries render formats, the malicious server returns a crafted RenderQueryPictFormats reply that triggers a heap overflow in the client's libXrender, letting the attacker inject and run code in the client process. No public exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 21, 2026

Heap-based buffer overflow in X.Org libXrender before 0.9.13 allows a malicious or compromised X server to inject and execute arbitrary code in attached X11 clients via a crafted response to the RenderQueryPictFormats request. This is a reverse-direction attack where the victim must actively connect a vulnerable X11 client (linked against libXrender < 0.9.13) to an attacker-controlled or hijacked X server - typical exposure is via SSH X11 forwarding to an untrusted host or a remote DISPLAY connection; local trusted X servers are not affected. No public exploit code has been identified at time of analysis, and exploitation is non-trivial (AC:H) with no attacker authentication required (PR:N), but an upstream fix is available and the CVE description identifies 0.9.13 as the fixed version boundary.

RemediationAI

Apply the vendor fix by upgrading libXrender to version 0.9.13 or later, which is the fixed version boundary stated in the CVE description; the upstream patch is available as merge request 19 at https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19. Note that the fix is delivered as a merge request, so the released patched version (0.9.13) should be independently confirmed from your distribution vendor. If immediate upgrade is not feasible, the primary compensating control is to avoid connecting X11 clients to untrusted or compromised X servers: disable SSH X11 forwarding by default (set ForwardX11 no in ~/.ssh/config), and do not use remote DISPLAY connections to hosts you do not fully trust - the trade-off is loss of remote GUI application access for legitimate users. For workflows that require remote X11, tunnel the X11 protocol over an encrypted, authenticated transport such as SSH or a VPN to a trusted server, and verify server authenticity; this preserves functionality at the cost of additional configuration and performance overhead. Blocking outbound X11 connections to unknown servers at the network layer can reduce exposure but may disrupt legitimate remote display traffic. There is no need to change client authentication settings because the attack does not require attacker credentials. Patching only the X server is insufficient; the vulnerable client library must be updated. No public exploit code has been identified at time of analysis.

Affected VersionsENISA

libXrender 0 <0.9.13

Affected Packages

euvd libxrender fix: 0.9.13

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

X.Org libXrender is the client-side library implementing the X Rendering Extension, which provides anti-aliased graphics and compositing primitives for X11. The vulnerable function, RenderQueryPictFormats, is called by an X11 client to ask the X server which picture formats it supports. The server sends back a reply that the client parses; a heap-based buffer overflow (CWE-122) in that parsing logic occurs because the client fails to properly validate the length or format of the server-provided data. Unlike the usual X11 threat model where the server is trusted, this vulnerability reverses the trust direction: a malicious or compromised X server can exploit the client. The CVSS:3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H confirms network reachability, high attack complexity, no privileges required, user interaction (the victim initiates the connection), unchanged scope, and high confidentiality, integrity, and availability impact. The CVSS:4.0 vector uses UI:A (active) and similarly rates impact as high across vulnerable and subsequent systems. Any X11 client linked against libXrender prior to 0.9.13 is theoretically affected when it connects to an untrusted X server, and the upstream fix is provided in merge request 19 on the freedesktop.org GitLab.

Know when Libxrender gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (suse) PRIMARY 8.9 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
vuln.today AI 7.5 HIGH

Attacker controls a remote X server (AV:N, PR:N); victim must connect (UI:R); heap-overflow exploitation is complex (AC:H); code injection into the client process yields full C:H/I:H/A:H, confined to that process (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 8.3 HIGH

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
High

DescriptionCVE.org

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

Executive ViewAI

Why It Matters

A heap buffer overflow in X.Org's libXrender library (versions before 0.9.13) can let a hostile or hijacked X server run arbitrary code inside the X11 clients that connect to it, putting engineering, research, and administrative workstations that use remote X11 sessions at risk. The exposure path is unusual: the attacker must first control the X server a user connects to, typically through SSH X11 forwarding to an untrusted host or a remote DISPLAY session, so routine local desktop use is unaffected. Because the consequence is code execution on the end-user endpoint rather than on a shared server, leadership should treat this as a targeted compromise risk for a limited but privileged population of users, not a broad enterprise outage.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Prevalence
High
core X11 client library on nearly all Linux/Unix X11 desktops
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Libxrender

View all
CVE-2016-7949 CRITICAL
9.8 Dec 13

Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.1
CVE-2016-7950 CRITICAL
9.8 Dec 13

The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds writ
CVE-2013-1987 MEDIUM
6.8 Jun 15

Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient m

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container bci/openjdk-devel:17.0.20.1-21.70 Container bci/openjdk-devel:21.0.12.1-25.68 Container bci/openjdk-devel:25.0.4.1-9.69 Container bci/openjdk:17.0.20.1-20.60 Container bci/openjdk:21.0.12.1-24.57 Container bci/openjdk:25.0.4.1-9.57 Container suse/kiosk/firefox-esr:153.3-75.44 Container suse/kiosk/pulseaudio:17.0-73.42 Container suse/kiosk/tigervnc-x11vnc:1.14-63.43 Container suse/kiosk/xorg-client:21-81.7 Container suse/kiosk/xorg:21.1-83.42 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
PATCH https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f0 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54 ADVISORY https://gitlab.freedesktop.org/xorg/lib/libxtst/-/commit/ac60f5f47 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-88807 ADVISORY https://seclists.org/oss-sec/2026/q4/212 ADVISORY https://vuldb.com/vuln/408117 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23886/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23900/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4395/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4397/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy