vulnwire
7.8high

CVE-2026-96889

Librsvg: use-after-free when xml includes have duplicated entities

Also known as GHSA-cpvr-w4j5-2mpg, RUSTSEC-2026-0305

Published 44 d ago · modified 2 d ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 47%
Public exploits
0
none known

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
total
Assessed
42 d ago

Exploit prediction (EPSS)

0.56% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
crates.iolibrsvg
<2.57.5
>=2.60.0-beta.0, <2.60.3
>=2.61.0, <2.61.5
>=2.62.0-beta.0, <2.62.4
>=2.63.0-beta.0, <2.63.2
>=0.0.0-0, <2.57.5
>=2.57.90, <2.60.3
>=2.61.90, <2.62.4
>=2.62.90, <2.63.2
2.57.5
2.60.3
2.61.5
2.62.4
2.63.2

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift AI 3.0
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI 3.5
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.