CVE-2026-96889 Librsvg: use-after-free when xml includes have duplicated entities
An attacker can trigger a use-after-free in librsvg via crafted SVG files, potentially leading to arbitrary code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-96889?
CVE-2026-96889 is a high-severity use after free vulnerability in Red Hat Enterprise Linux 10, published on 23 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
Weakness: CWE-416
Which versions are affected by CVE-2026-96889?
11 open source packages ship an affected version, including librsvg.
| Package | Affected | Fixed in |
|---|---|---|
librsvg crates.io | All versions | 2.57.5 |
librsvg crates.io | All versions | 2.57.5 |
librsvg crates.io | From 0.0.0-0 | 2.57.5, 2.60.3, 2.61.5, 2.62.4, 2.63.2 |
librsvg crates.io | From 2.60.0-beta.0 | 2.60.3 |
librsvg crates.io | From 2.60.0-beta.0 | 2.60.3 |
librsvg crates.io | From 2.61.0 | 2.61.5 |
5 more packages
librsvg crates.io | From 2.61.0 | 2.61.5 |
librsvg crates.io | From 2.62.0-beta.0 | 2.62.4 |
librsvg crates.io | From 2.62.0-beta.0 | 2.62.4 |
librsvg crates.io | From 2.63.0-beta.0 | 2.63.2 |
librsvg crates.io | From 2.63.0-beta.0 | 2.63.2 |
Linux distribution packages (19)
glycin-loaders AlmaLinux:10 | All versions | 1.0.1-1.el10_2.2 |
librsvg2 AlmaLinux:10 | All versions | 2.57.1-9.el10_2.10 |
librsvg2-devel AlmaLinux:10 | All versions | 2.57.1-9.el10_2.10 |
librsvg2-tools AlmaLinux:10 | All versions | 2.57.1-9.el10_2.10 |
rsvg-pixbuf-loader AlmaLinux:10 | All versions | 2.57.1-9.el10_2.10 |
librsvg2 AlmaLinux:8 | All versions | 2.42.7-6.el8_10 |
librsvg2-devel AlmaLinux:8 | All versions | 2.42.7-6.el8_10 |
librsvg2-tools AlmaLinux:8 | All versions | 2.42.7-6.el8_10 |
librsvg2 AlmaLinux:9 | All versions | 2.50.7-3.el9_8.1 |
librsvg2-devel AlmaLinux:9 | All versions | 2.50.7-3.el9_8.1 |
librsvg2-tools AlmaLinux:9 | All versions | 2.50.7-3.el9_8.1 |
glycin-loaders Rocky Linux:10 | All versions | 0:1.0.1-1.el10_2.2 |
librsvg2 Rocky Linux:10 | All versions | 0:2.57.1-9.el10_2.10 |
librsvg2 Rocky Linux:8 | All versions | 0:2.42.7-6.el8_10 |
librsvg2 Rocky Linux:9 | All versions | 0:2.50.7-3.el9_8.1 |
librsvg SUSE:Linux Enterprise Server 16.0 | All versions | 2.60.3-160000.1.1 |
librsvg SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.60.3-160000.1.1 |
librsvg SUSE:Linux Micro 6.2 | All versions | 2.60.3-160000.1.1 |
librsvg openSUSE:Leap 16.0 | All versions | 2.60.3-160000.1.1 |
How do I fix CVE-2026-96889?
Upgrade librsvg to a fixed version for your release line: 2.57.5, 2.60.3, 2.61.5 or 2.62.4.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-96889 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-96889 exists.
Public exploit code: 5 proofs of concept on GitHub.
Sources
Also known as ALSA-2026:86331, ALSA-2026:86841, ALSA-2026:86842, ALSA-2026:86921, AZL-104931, BELL-CVE-2026-96889 and 19 more.