Threats affecting pkg:deb/debian/libxrender

CVE-2026-88807 is a heap-based buffer overflow vulnerability in the libXrender library used by X.org. The flaw exists in the RenderQueryPictFormats function in libXrender versions before 0.9.13. A malicious X server could exploit this vulnerability to inject code into connected X clients. The vulnerability has a high severity score of 8.9 (CVSS 4.0) and requires user interaction with a high attack complexity. No known exploits are reported in the wild. A fix is implied to exist in version 0.9.13 and later.