LibXrender Security Update — AlmaLinux 8 (ALSA-2026:91267)

ALSA-2026:91267 updates libXrender on AlmaLinux 8, fixing CVE-2026-88807 — code injection via a heap overflow in RenderQueryPictFormats (CWE-122), rated CVSS 8.9. Update with dnf update libXrender and restart any X applications; headless servers that have the library installed but unused can update or remove it.

High 8.9 CVSS 2026-10-27

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

The flaw is triggered client-side by a malicious X server feeding crafted render data — in VDI and remote-app setups, one compromised X server can run code inside every connecting client.

Type:

security

Severity:

important

Release date:

2026-10-27

Description:

X.Org X11 libXrender runtime library

Security Fix(es):

* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	libXrender-0.9.10-8.el8_10.aarch64.rpm	7c5c3213be34fcd2da690a91f6a02ce6d3a9865a88736d7b152d7f4ad0bed768
aarch64	libXrender-devel-0.9.10-8.el8_10.aarch64.rpm	e1e0352d72ab1ac8a03cb4b34fe0999b2a69236261511100b31f73aec1dbdc6a
i686	libXrender-devel-0.9.10-8.el8_10.i686.rpm	5d529566530af687f4d066e8060a0dd079854c1f7738af99bc6a6fa6017f8b5f
i686	libXrender-0.9.10-8.el8_10.i686.rpm	f345f41aceff439499d57dd5c39c35b1946a7513b8dca584cd0c542035a0942c
ppc64le	libXrender-devel-0.9.10-8.el8_10.ppc64le.rpm	1e423c038481fd20fb292e8692941037f058b45dd2db02a3bb5396343191394f
ppc64le	libXrender-0.9.10-8.el8_10.ppc64le.rpm	ddb081b4aa77e646bb917820310d11328a71efa9186d6631ca7d15cd7b9f77be
s390x	libXrender-devel-0.9.10-8.el8_10.s390x.rpm	4dc5bac16c2cc33eeeed22f1c099c24baacd84fc9a5abd3d8b74eb455b6459e6
s390x	libXrender-0.9.10-8.el8_10.s390x.rpm	bb4094e5fa40924a94f04ed8e89708dc341b262333e5f12976772b7469a296fe
x86_64	libXrender-0.9.10-8.el8_10.x86_64.rpm	a64e8c0887e2c085b6ae5d969ca7d0d53b117047aad1cbd0347f609d98f98c8c
x86_64	libXrender-devel-0.9.10-8.el8_10.x86_64.rpm	ed87a43a4d1bd7e00a7e37ed4abe52a033c859c550e9576915331cddfb2e5e59

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is CVE-2026-88807?

It is a heap overflow leading to code injection (CWE-122) in libXrender's RenderQueryPictFormats function, rated CVSS 8.9 and fixed in the AlmaLinux 8 update ALSA-2026:91267.

Who is affected?

Systems running X11 applications that connect to an X server — the client library parses the server's responses, so a malicious or compromised X server is the attack source. Headless hosting servers without X installed are not exposed.

How do I apply the fix?

Run dnf update libXrender and restart graphical applications. On headless servers where the library exists but nothing uses X, either update it or remove it to eliminate the surface.

Why do libX flaws keep appearing alongside each other?

The X11 client libraries share protocol-parsing code and maintenance, so security batches often land the same week — this libXrender fix arrived with the libXtst update (ALSA-2026:91294) in the same window.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen