libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats

A flaw was found in libXrender. Malicious X servers can exploit a heap overflow vulnerability in the RenderQueryPictFormats function. This allows them to inject arbitrary code into connected X clients, potentially leading to unauthorized control over the client's system...

CVE-2026-93524

A buffer overread exists in the CheckKeySyms() function within the X.Org X Server (versions before 21.1.25 ) and XWayland (versions before 24.1.14 ). The root cause is a desynchronization during the SetMap request: when the first loop populates a validation array for new key widths, the second lo...

CVE-2026-93522

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context...

EUVD-2026-112256

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

EUVD-2026-112146

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

CVE-2026-93519 X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

EUVD-2026-112075

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libXrender (UTSA-2026-142327)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142327 advisory. A heap overflow in libXrender before 0.9.13 inRenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. Tenable has extract...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Issue Correction: Run dnf update libXrender --releasever 2023.12.20261012 or dnf update...

Amazon Linux 2023 : libXrender, libXrender-devel (ALAS2023-2026-3178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3178 advisory. A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Tenable has extracted the preceding...

EulerOS 2.0 SP15 : libXfont2 (EulerOS-SA-2026-3917)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client...

CVE-2026-94283

An out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

AZL-104969 CVE-2026-94286 affecting package libXtst 1.2.4-1

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...

CVE-2026-94285

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

CVE-2026-94286

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...

CVE-2026-94286 Out-of-bounds read in libXtst's RECORD reply parser

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...

CVE-2026-94285

The libX11 library (versions before 1.8.14 ) is susceptible to an out-of-bounds read vulnerability within its byte-oriented codeset parser . This flaw could be exploited by a malicious X server to cause a crash in attached X clients. No information regarding specific exploits or in-the-wild explo...

CVE-2026-94284 Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

CVE-2026-94286: Buffer Over-read

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...