diff --git a/libX11-1.8.7-CVE-2026-88806.patch b/libX11-1.8.7-CVE-2026-88806.patch
new file mode 100644
index 0000000000000000000000000000000000000000..77e1c4e90eca125aad5a9aa3e1c0b22ba5ea77d7
--- /dev/null
+++ b/libX11-1.8.7-CVE-2026-88806.patch
@@ -0,0 +1,38 @@
+From f371943bfc62e9951bf8e27174df8790f320b635 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 16 Sep 2026 15:27:33 +1000
+Subject: [PATCH] xkb: Check the keysym range in _XkbReadKeyActions
+ (CVE-2026-88806)
+
+A malicious server could send a XkbGetMap reply with
+firstKeyAct + nKeyActs exceeding max_keycode=+ 1. This would
+cause an OOB write into info->map->key_sym_map[rep->firstKeyAct + i].
+
+This brings this function in line with the other functions in this file
+which already have checks in place.
+
+This vulnerability was discovered by:
+Adam Bedard working with TrendAI Zero Day Initiative
+
+ZDI-CAN-32061
+
+CVE-2026-88806
+
+Assisted-by: Claude:claude-opus-4-6
+---
+ src/xkb/XKBGetMap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
+index 31199e4..eaa0d6d 100644
+--- a/src/xkb/XKBGetMap.c
++++ b/src/xkb/XKBGetMap.c
+@@ -253,6 +253,9 @@ _XkbReadKeyActions(XkbReadBufferPtr buf, XkbDescPtr info, xkbGetMapReply *rep)
+     if ((nKeyActs = rep->nKeyActs) > 0) {
+         XkbSymMapPtr symMap;
+ 
++        if (((int) rep->firstKeyAct + rep->nKeyActs) > (info->max_key_code + 1))
++            return BadLength;
++
+         if (nKeyActs < sizeof numDescBuf)
+             numDesc = numDescBuf;
+         else
diff --git a/libX11.spec b/libX11.spec
index b6d1dce8bb4f3c019824eacec127c670fd44faf0..75b8446d7cbebdd61947b42c9a9deab9ec69626d 100644
--- a/libX11.spec
+++ b/libX11.spec
@@ -1,11 +1,12 @@
 Summary: Core X11 protocol client library
 Name: libX11
 Version: 1.8.7
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: MIT AND X11
 URL: http://www.x.org
 Source0: https://xorg.freedesktop.org/archive/individual/lib/libX11-%{version}.tar.xz
 Patch3000: dont-forward-keycode-0.patch
+Patch0001: libX11-1.8.7-CVE-2026-88806.patch
 
 BuildRequires: make
 BuildRequires: xorg-x11-util-macros >= 1.11 xorg-x11-xtrans-devel >= 1.0.3-4
@@ -83,6 +84,10 @@ make check
 %{_mandir}/man5/*.5*
 
 %changelog
+* Wed Sep 23 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 1.8.7-4
+- [Type] security
+- [DESC] Fix CVE-2026-88806: heap buffer overflow in _XkbReadKeyActions (XkbGetMap)
+
 * Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 1.8.7-3
 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream