CVE-2026-96889

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in librsvg Due to Nested XIncludes

Publication date: 2026-09-23

Last updated on: 2026-09-25

Assigner: redhat-SADP

Description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-25

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-96889

EUVD

EUVD-2026-85608

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	librsvg	*
gnome	librsvg	2.63.1
gnome	librsvg	2.63.2
gnome	librsvg	2.62.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free flaw in librsvg, a library for rendering SVG files. It occurs when processing an SVG with nested XIncludes containing duplicate XML entity declarations. The library incorrectly frees an XML entity still in use by the parser, leading to potential memory corruption.

Detection Guidance

Detecting this vulnerability requires checking the version of librsvg installed on your system. Use commands like 'rpm -q librsvg' for RPM-based systems or 'dpkg -l librsvg' for Debian-based systems to verify if the installed version is below 2.63.1. If the version is older, the system is vulnerable.

Impact Analysis

An attacker could exploit this to cause a denial of service or execute arbitrary code by tricking a user into opening a malicious SVG file. Exploitation requires user interaction, such as opening a crafted file.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in librsvg that could lead to denial of service or arbitrary code execution if exploited. Compliance impact would depend on how the affected software is used in a system handling regulated data.

Mitigation Strategies

Upgrade librsvg to version 2.63.1 or later. If using a distribution-specific package, check for patched versions. Avoid opening untrusted SVG files until patched.

Hi! I’m here to help you understand CVE-2026-96889. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70