Back Linuxsecurity

Oracle Linux 8 libXrender Fixes RenderQueryPictFormats Code Injection

Linuxsecurity •LinuxSecurity Advisories • October 28, 2026

Two serious PHP flaws could let an attacker run code without logging in. See which setups and PHP versions are affected ×

[0.9.10-8] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats

libXrender-0.9.10-8.el8_10.i686.rpm libXrender-0.9.10-8.el8_10.x86_64.rpm libXrender-devel-0.9.10-8.el8_10.i686.rpm libXrender-devel-0.9.10-8.el8_10.x86_64.rpm

libXrender-0.9.10-8.el8_10.aarch64.rpm libXrender-devel-0.9.10-8.el8_10.aarch64.rpm

Related CVEs: CVE-2026-88807

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle libXrender Heap Overflow Vulnerability Patched Oracle has released updates addressing a heap overflow vulnerability in libXrender, identified as CVE-2026-88807, which allows code injection via the RenderQueryPictFormats function. The flaw affects multiple versions of libXrender across different Oracle Linux distributions, including versions 0.9.10-16 and 0.9.11-8.1. Users are advised to update their systems to the latest versions to mitigate the risk of exploitation. The vulnerability has a CVSS score of 8.9, indicating a high severity level. The patch was made available on 2026-10-28 for Oracle Linux 8 and 10, with additional updates for Oracle Linux 9 released on 2026-10-30. No has been reported as of now, but the potential for exploitation remains high due to the nature of the flaw. 3 sources 58

Extracted Entities

Oracle Linux 8 libXrender Fixes RenderQueryPictFormats Code Injection

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

Vulnerabilities (1)