CVE-2026-88807

HighCVSS 8.9/10Last modified Sep 22, 2026

Description

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

Metrics

CVSS 4.0 8.9/10CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
X.orglibXrender< 0.9.13

References

Timeline

Published
Sep 21, 2026
Last modified
Sep 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-888088.8A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own clusteCVE-2026-888097.6A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requestsCVE-2026-88817.5Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES encryption. MD5 hasCVE-2026-888107.2A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRoCVE-2026-888119.1Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affCVE-2026-888127.8A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a cCVE-2026-888135.3The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actCVE-2026-888143.7The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed CVE-2026-888156.2DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_typeCVE-2026-888167.5DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointeCVE-2026-888178.7An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group wCVE-2026-888196.3In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
CVE-2026-88807: High severity, CVSS 8.9 | Vulnix