Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-96889

Fixed in a distro release EPSS <1%CVSS 7.8

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Published 2026-09-23 · CVE record · OSV

Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7

Fixed upstream

EcosystemPackageFixed in
crates.iolibrsvg2.57.5
crates.iolibrsvg2.60.3
crates.iolibrsvg2.61.5
crates.iolibrsvg2.62.4
crates.iolibrsvg2.63.2

Distro releases

ReleasePackageFixed in
AlmaLinux 10glycin-loaders1.0.1-1.el10_2.2
AlmaLinux 10librsvg22.57.1-9.el10_2.10
AlmaLinux 10librsvg2-devel2.57.1-9.el10_2.10
AlmaLinux 10librsvg2-tools2.57.1-9.el10_2.10
AlmaLinux 10rsvg-pixbuf-loader2.57.1-9.el10_2.10
AlmaLinux 8librsvg22.42.7-6.el8_10
AlmaLinux 8librsvg2-devel2.42.7-6.el8_10
AlmaLinux 8librsvg2-tools2.42.7-6.el8_10
AlmaLinux 9librsvg22.50.7-3.el9_8.1
AlmaLinux 9librsvg2-devel2.50.7-3.el9_8.1
AlmaLinux 9librsvg2-tools2.50.7-3.el9_8.1
Chainguardwleave0.7.1-r1
Debian 12librsvgno fix
Debian 13librsvg2.60.0+dfsg-1+deb13u1
Debian 14librsvg2.63.2+dfsg-1
Rocky Linux 10glycin-loaders0:1.0.1-1.el10_2.2
Rocky Linux 10librsvg20:2.57.1-9.el10_2.10
Rocky Linux 8librsvg20:2.42.7-6.el8_10
Rocky Linux 9librsvg20:2.50.7-3.el9_8.1
SUSE Linux Enterprise Server 16.0librsvg2.60.3-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0librsvg2.60.3-160000.1.1
SUSE Linux Micro 6.2librsvg2.60.3-160000.1.1
Ubuntu 24.04 LTSlibrsvg2.58.0+dfsg-1ubuntu0.1
Ubuntu 26.04 LTSlibrsvg2.61.3+dfsg-3ubuntu0.1
openSUSE Leap 16.0librsvg2.60.3-160000.1.1