Vulnerability-Lookup

CVE-2026-96889 (GCVE-0-2026-96889)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:40 – Updated: 2026-09-25 17:53

Title

Librsvg: use-after-free when xml includes have duplicated entities

Summary

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 17:53 UTC

CWE

CWE-416 - Use After Free

Assigner

redhat CNA under the redhat root

CNA scorecard B 81/100 over 1016 records in the last 180 days details

References

5 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-96889	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2539279	issue-trackingx_refsource_REDHAT
https://crates.io/crates/librsvg
https://gitlab.gnome.org/GNOME/librsvg/-/work_ite…
https://rustsec.org/advisories/RUSTSEC-2026-0305.html

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-09-23 12:00

Credits

Red Hat would like to thank Rafael B. Dias for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96889",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T17:53:42.623078Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T17:53:52.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glycin-loaders",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Rafael B. Dias for reporting this issue."
        }
      ],
      "datePublic": "2026-09-23T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:40:14.793Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-96889"
        },
        {
          "name": "RHBZ#2539279",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
        },
        {
          "url": "https://crates.io/crates/librsvg"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
        },
        {
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T09:29:12.429Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-23T12:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Librsvg: use-after-free when xml includes have duplicated entities",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-96889",
    "datePublished": "2026-09-23T19:40:14.793Z",
    "dateReserved": "2026-09-23T18:52:33.922Z",
    "dateUpdated": "2026-09-25T17:53:52.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-96889",
      "date": "2026-10-15",
      "epss": "0.00151",
      "percentile": "0.03856"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T14:50:13.000Z",
      "cve": "CVE-2026-96889",
      "id": "msrc_CVE-2026-96889",
      "initial_release_date": "2026-09-27T23:30:17.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Librsvg: use-after-free when xml includes have duplicated entities",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-96889.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:10"
                ],
                "defaultStatus": "affected",
                "packageName": "glycin-loaders",
                "product": "Red Hat Enterprise Linux 10",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:10"
                ],
                "defaultStatus": "affected",
                "packageName": "librsvg2",
                "product": "Red Hat Enterprise Linux 10",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:6"
                ],
                "defaultStatus": "unknown",
                "packageName": "librsvg2",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "affected",
                "packageName": "librsvg2",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:8"
                ],
                "defaultStatus": "affected",
                "packageName": "librsvg2",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "affected",
                "packageName": "librsvg2",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat"
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."
          }
        ],
        "id": "CVE-2026-96889",
        "lastModified": "2026-09-25T18:17:34.240",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-96889",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T17:53:42.623078Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-23T20:17:27.587",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2026-96889"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://crates.io/crates/librsvg"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-23T20:02:32+00:00",
      "cve": "CVE-2026-96889",
      "id": "CVE-2026-96889",
      "initial_release_date": "2026-09-23T12:00:00+00:00",
      "product_status:known_affected": "20",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "librsvg: Use-after-free when XML includes have duplicated entities",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96889.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-96889",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-25T17:53:42.623078Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-25T17:53:18.774Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "glycin-loaders",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "librsvg2",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:6"
              ],
              "defaultStatus": "unknown",
              "packageName": "librsvg2",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "librsvg2",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "librsvg2",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "librsvg2",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Rafael B. Dias for reporting this issue."
            }
          ],
          "datePublic": "2026-09-23T12:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "Use After Free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-23T19:40:14.793Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-96889"
            },
            {
              "name": "RHBZ#2539279",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
            },
            {
              "url": "https://crates.io/crates/librsvg"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
            },
            {
              "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-23T09:29:12.429Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-23T12:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Librsvg: use-after-free when xml includes have duplicated entities",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-416: Use After Free"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-96889",
        "datePublished": "2026-09-23T19:40:14.793Z",
        "dateReserved": "2026-09-23T18:52:33.922Z",
        "dateUpdated": "2026-09-25T17:53:52.750Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-OL77428 (CVE-2026-96889)

Vulnerability from cleanstart – Published: 2026-10-15 00:40 – Updated: 2026-10-14 12:19 – Source website

Summary

flaw was found in librsvg

Details

Security vulnerability affects the langfuse package. A flaw was found in librsvg.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-96889	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-96889	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse",
        "purl": "pkg:apk/cleanstart/langfuse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.35.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the langfuse package. A flaw was found in librsvg.",
  "id": "CLEANSTART-2026-OL77428",
  "modified": "2026-10-14T12:19:50Z",
  "published": "2026-10-15T00:40:56.641655Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OL77428.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-96889"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96889"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "flaw was found in librsvg",
  "upstream": [
    "CVE-2026-96889"
  ]
}

FKIE_CVE-2026-96889

Vulnerability from fkie_nvd - Published: 2026-09-23 20:17 - Updated: 2026-09-25 18:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2026-96889
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2539279
	secalert@redhat.com	https://crates.io/crates/librsvg
	secalert@redhat.com	https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
	secalert@redhat.com	https://rustsec.org/advisories/RUSTSEC-2026-0305.html
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glycin-loaders",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."
    }
  ],
  "id": "CVE-2026-96889",
  "lastModified": "2026-09-25T18:17:34.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-96889",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-25T17:53:42.623078Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T20:17:27.587",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-96889"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://crates.io/crates/librsvg"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

MSRC_CVE-2026-96889

Vulnerability from csaf_microsoft - Published: 2026-09-27 23:30 - Updated: 2026-10-07 02:00

Summary

Librsvg: use-after-free when xml includes have duplicated entities

Scope

1 vulnerability in this advisory, including CVE-2026-96889.

CVE-2026-96889

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 1 product Known affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

RUSTSEC-2026-0305 (CVE-2026-96889)

Vulnerability from osv_rustsec – Published: 2026-09-23 12:00 – Updated: 2026-10-01 19:14 – Source website

Summary

Use-after-free when XML includes have duplicated entities

Details

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error.

While libxml2 is expanding an internal entity, a recursive XInclude can parse another document that declares an entity with the same name. Both parses use the same XmlState entity map on the librsvg side. entity_insert() replaces the first entry, whose Drop implementation calls xmlFreeNode(). The outer xmlCtxtParseEntity() then keeps using the freed 144-byte xmlEntity.

The included parse should not free an entity that the outer parser is still using.

The fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where librsvg will no longer free xmlEntity pointers that libxml2 is still using.

References

URL

Type

	https://crates.io/crates/librsvg	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0305.html	ADVISORY
	https://gitlab.gnome.org/GNOME/librsvg/-/work_ite…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "librsvg",
        "purl": "pkg:cargo/librsvg"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "2.57.5"
            },
            {
              "introduced": "2.57.90"
            },
            {
              "fixed": "2.60.3"
            },
            {
              "introduced": "2.61.0"
            },
            {
              "fixed": "2.61.5"
            },
            {
              "introduced": "2.61.90"
            },
            {
              "fixed": "2.62.4"
            },
            {
              "introduced": "2.62.90"
            },
            {
              "fixed": "2.63.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-96889"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Librsvg uses libxml2, a C library, to parse XML.  When librsvg parses\nan SVG document which has a nested Xinclude, an XML entity declaration\nwith a duplicate name as an existing one can cause a use-after-free error.\n\nWhile libxml2 is expanding an internal entity, a recursive XInclude\ncan parse another document that declares an entity with the same\nname. Both parses use the same `XmlState` entity\nmap on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop`\nimplementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()`\nthen keeps using the freed 144-byte `xmlEntity`.\n\nThe included parse should not free an entity that the outer parser is still using.\n\nThe fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where\nlibrsvg will no longer free xmlEntity pointers that libxml2 is still\nusing.",
  "id": "RUSTSEC-2026-0305",
  "modified": "2026-10-01T19:14:05Z",
  "published": "2026-09-23T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/librsvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Use-after-free when XML includes have duplicated entities"
}

SUSE-SU-2026:24117-1

Vulnerability from csaf_suse - Published: 2026-10-08 06:13 - Updated: 2026-10-13 09:46

Summary

Security update for librsvg

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2026-96889.

CVE-2026-96889

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 8 products

Open the full advisory

UBUNTU-CVE-2026-96889 (CVE-2026-96889)

Vulnerability from osv_ubuntu – Published: 2026-09-23 20:17 – Updated: 2026-10-06 21:04 – Source website

Details

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-96889	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-96889	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2539279	REPORT
	https://rustsec.org/advisories/RUSTSEC-2026-0305.html	REPORT
	https://gitlab.gnome.org/GNOME/librsvg/-/work_ite…	REPORT
	https://access.redhat.com/security/cve/CVE-2026-96889	REPORT
	https://crates.io/crates/librsvg	REPORT
	https://ubuntu.com/security/notices/USN-8891-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-rsvg-2.0",
            "binary_version": "2.58.0+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-2",
            "binary_version": "2.58.0+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-bin",
            "binary_version": "2.58.0+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-common",
            "binary_version": "2.58.0+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-tests",
            "binary_version": "2.58.0+dfsg-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "librsvg",
        "purl": "pkg:deb/ubuntu/librsvg@2.58.0+dfsg-1ubuntu0.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.58.0+dfsg-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.54.7+dfsg-2",
        "2.57.91+dfsg-2ubuntu1",
        "2.58.0+dfsg-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-rsvg-2.0",
            "binary_version": "2.61.3+dfsg-3ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-2",
            "binary_version": "2.61.3+dfsg-3ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-bin",
            "binary_version": "2.61.3+dfsg-3ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-common",
            "binary_version": "2.61.3+dfsg-3ubuntu0.1"
          },
          {
            "binary_name": "librsvg2-tests",
            "binary_version": "2.61.3+dfsg-3ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "librsvg",
        "purl": "pkg:deb/ubuntu/librsvg@2.61.3+dfsg-3ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.61.3+dfsg-3ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.60.0+dfsg-1build1",
        "2.61.3+dfsg-2",
        "2.61.3+dfsg-3"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.",
  "id": "UBUNTU-CVE-2026-96889",
  "modified": "2026-10-06T21:04:59Z",
  "published": "2026-09-23T20:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-96889"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96889"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
    },
    {
      "type": "REPORT",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-96889"
    },
    {
      "type": "REPORT",
      "url": "https://crates.io/crates/librsvg"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8891-1"
    }
  ],
  "related": [
    "USN-8891-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-96889"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-96889 (GCVE-0-2026-96889)

CLEANSTART-2026-OL77428 (CVE-2026-96889)

FKIE_CVE-2026-96889

MSRC_CVE-2026-96889

RUSTSEC-2026-0305 (CVE-2026-96889)

SUSE-SU-2026:24117-1

UBUNTU-CVE-2026-96889 (CVE-2026-96889)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour