Back to Security Advisories

LibXrender Security Update — AlmaLinux 8 (ALSA-2026:91267)

ALSA-2026:91267 updates libXrender on AlmaLinux 8, fixing CVE-2026-88807 — code injection via a heap overflow in RenderQueryPictFormats (CWE-122), rated CVSS 8.9. Update with dnf update libXrender and restart any X applications; headless servers that have the library installed but unused can update or remove it.

High 8.9 CVSS
AlmaLinux 8

What this means under a SharedLicense license

The flaw is triggered client-side by a malicious X server feeding crafted render data — in VDI and remote-app setups, one compromised X server can run code inside every connecting client.

Type:

security

Severity:

important

Release date:

2026-10-27

Description:

X.Org X11 libXrender runtime library

Security Fix(es):

* libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 libXrender-0.9.10-8.el8_10.aarch64.rpm 7c5c3213be34fcd2da690a91f6a02ce6d3a9865a88736d7b152d7f4ad0bed768
aarch64 libXrender-devel-0.9.10-8.el8_10.aarch64.rpm e1e0352d72ab1ac8a03cb4b34fe0999b2a69236261511100b31f73aec1dbdc6a
i686 libXrender-devel-0.9.10-8.el8_10.i686.rpm 5d529566530af687f4d066e8060a0dd079854c1f7738af99bc6a6fa6017f8b5f
i686 libXrender-0.9.10-8.el8_10.i686.rpm f345f41aceff439499d57dd5c39c35b1946a7513b8dca584cd0c542035a0942c
ppc64le libXrender-devel-0.9.10-8.el8_10.ppc64le.rpm 1e423c038481fd20fb292e8692941037f058b45dd2db02a3bb5396343191394f
ppc64le libXrender-0.9.10-8.el8_10.ppc64le.rpm ddb081b4aa77e646bb917820310d11328a71efa9186d6631ca7d15cd7b9f77be
s390x libXrender-devel-0.9.10-8.el8_10.s390x.rpm 4dc5bac16c2cc33eeeed22f1c099c24baacd84fc9a5abd3d8b74eb455b6459e6
s390x libXrender-0.9.10-8.el8_10.s390x.rpm bb4094e5fa40924a94f04ed8e89708dc341b262333e5f12976772b7469a296fe
x86_64 libXrender-0.9.10-8.el8_10.x86_64.rpm a64e8c0887e2c085b6ae5d969ca7d0d53b117047aad1cbd0347f609d98f98c8c
x86_64 libXrender-devel-0.9.10-8.el8_10.x86_64.rpm ed87a43a4d1bd7e00a7e37ed4abe52a033c859c550e9576915331cddfb2e5e59

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-88807?
It is a heap overflow leading to code injection (CWE-122) in libXrender's RenderQueryPictFormats function, rated CVSS 8.9 and fixed in the AlmaLinux 8 update ALSA-2026:91267.
Who is affected?
Systems running X11 applications that connect to an X server — the client library parses the server's responses, so a malicious or compromised X server is the attack source. Headless hosting servers without X installed are not exposed.
How do I apply the fix?
Run dnf update libXrender and restart graphical applications. On headless servers where the library exists but nothing uses X, either update it or remove it to eliminate the surface.
Why do libX flaws keep appearing alongside each other?
The X11 client libraries share protocol-parsing code and maintenance, so security batches often land the same week — this libXrender fix arrived with the libXtst update (ALSA-2026:91294) in the same window.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System