High ELSA-2026-91267 1 CVE

Important: libXrender security update (Oracle Linux 8)

Published Oct 27, 2026 · Updated Oct 27, 2026

Ecosystem: Oracle Linux

Summary

[0.9.10-8]
- CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats
in RenderQueryPictFormats

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	libXrender	0:0.9.10-8.el8_10
Oracle Linux · 8	libXrender-devel	0:0.9.10-8.el8_10

Vulnerabilities 1

High 8.9

CVE-2026-88807

libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

X.Org libXrender libxrender libxrender Debian Ubuntu Azure Linux Alpine

Sep 21, 2026