libXrender-0.9.13 (Xorg library)

[Bruce Dubbs]

New point version.

[Joe Locash]

libXrender - library for the Render Extension to the X11 protocol
-----------------------------------------------------------------

This release fixes CVE-2026-88807.  For more information, see the advisory:
https://lists.x.org/archives/xorg-announce/2026-October/003752.html

It also adds support for building with meson as well as autoconf.
Please test building with meson and report any issues you hit to:
  https://gitlab.freedesktop.org/xorg/lib/libxrender/-/issues
as we plan on removing the autoconf build support in a future release.

Alan Coopersmith (3):
      meson: Add option to build with meson
      gitlab CI: drop the ci-fairy check-mr job
      libXrender 0.9.13

Peter Hutterer (1):
      Check numSubpixel against numScreens to avoid OOB writes (CVE-2026-88807)

git tag: libXrender-0.9.13

From ​https://lists.x.org/archives/xorg-announce/2026-October/003752.html

========================================================================
libXrender - 1 CVE
========================================================================

* CVE-2026-88807:
  Out-of-bounds read in libXrender's XRenderQueryFormat reply parser.

  A malicious server could reply to XRenderQueryFormat with a numSubpixels
  count greater than the number of screens, causing an OOB write into
  screen->subpixel which was allocated using numScreens.

  Fixed in: libXrender 0.9.13
  Fix: https://gitlab.freedesktop.org/xorg/lib/libxrender/-/commit/0564bce54
  Found by: Adam Bedard working with TrendAI Zero Day Initiative (ZDI-CAN-32093)

Fixed at 4446ce7074. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-075 has been issued. This advisory covers five related Xorg libraries.