A heap overflow occurs in libXrender when handling RenderQueryPictFormats replies, allowing a malicious X server to corrupt memory and execute arbitrary code within attached X clients. The flaw conforms to CWE-122 and can overwrite return addresses, leading to control‑flow hijack and total compromise of client processes.

All installations of X.org's libXrender before version 0.9.13 are vulnerable on any platform that runs an X server using this library. The flaw is independent of the underlying operating system and affects any client that receives untrusted replies from the server.

The CVSS score of 8.9 reflects a high‑severity risk; an EPSS value of < 1% indicates a low but nonzero exploitation probability, and the vulnerability is not listed in the KEV catalog. Exploitation requires the attacker to control or compromise an X server that communicates with vulnerable clients; once the server sends a crafted RenderQueryPictFormats reply, the heap overflow can be used to inject code into any connected client. The likely attack vector is inferred from the description: it can be local if the attacker has access to the server, or remote if the server exposes the vulnerable endpoint over a network.