Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by redhat

CVE-2026-96889Librsvg: use-after-free when xml includes have duplicated entities

High 7.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10glycin-loaders1.0.1-1.el10_2.2ALSA-2026:86331
AlmaLinux:10librsvg22.57.1-9.el10_2.10ALSA-2026:86841
AlmaLinux:8librsvg22.42.7-6.el8_10ALSA-2026:86842
AlmaLinux:9librsvg22.50.7-3.el9_8.1ALSA-2026:86921
AlmaLinux:10librsvg2-devel2.57.1-9.el10_2.10ALSA-2026:86841
AlmaLinux:8librsvg2-devel2.42.7-6.el8_10ALSA-2026:86842
AlmaLinux:9librsvg2-devel2.50.7-3.el9_8.1ALSA-2026:86921
AlmaLinux:10librsvg2-tools2.57.1-9.el10_2.10ALSA-2026:86841
AlmaLinux:8librsvg2-tools2.42.7-6.el8_10ALSA-2026:86842
AlmaLinux:9librsvg2-tools2.50.7-3.el9_8.1ALSA-2026:86921
AlmaLinux:10rsvg-pixbuf-loader2.57.1-9.el10_2.10ALSA-2026:86841
Debian:12librsvgno fix listedDEBIAN-CVE-2026-96889
Debian:13librsvg2.60.0+dfsg-1+deb13u1DEBIAN-CVE-2026-96889
Debian:14librsvg2.63.2+dfsg-1DEBIAN-CVE-2026-96889
Rocky Linux:10glycin-loaders0:1.0.1-1.el10_2.2RLSA-2026:86331
Rocky Linux:10librsvg20:2.57.1-9.el10_2.10RLSA-2026:86841
Rocky Linux:8librsvg20:2.42.7-6.el8_10RLSA-2026:86842
Rocky Linux:9librsvg20:2.50.7-3.el9_8.1RLSA-2026:86921
Ubuntu:24.04:LTSlibrsvg2.58.0+dfsg-1ubuntu0.1USN-8891-1
Ubuntu:24.04:LTSlibrsvg2.58.0+dfsg-1ubuntu0.1UBUNTU-CVE-2026-96889
Ubuntu:26.04:LTSlibrsvg2.61.3+dfsg-3ubuntu0.1USN-8891-1
Ubuntu:26.04:LTSlibrsvg2.61.3+dfsg-3ubuntu0.1UBUNTU-CVE-2026-96889

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat OpenShift AI 3.0 see references
Red Hat Red Hat OpenShift AI 3.0 see references
Red Hat Red Hat OpenShift AI 3.0 see references
Red Hat Red Hat OpenShift AI 3.0 see references
Red Hat Red Hat OpenShift AI 3.0 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references
Red Hat Red Hat OpenShift AI 3.4 see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References