cyfenced.com →

[ CVE-2026-96889 · Published 23 Sep 2026 ]

Librsvg: Use-after-free when XML includes have duplicated entities

CVSS 7.8 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

[ Fixes ]Fixes and patches

  • librsvg 2.57.5Fixed version · GitHub Advisories · rust package librsvg: upgrade to 2.57.5 or later (affected < 2.57.5)
  • librsvg 2.60.3Fixed version · GitHub Advisories · rust package librsvg: upgrade to 2.60.3 or later (affected >= 2.60.0-beta.0, < 2.60.3)
  • librsvg 2.61.5Fixed version · GitHub Advisories · rust package librsvg: upgrade to 2.61.5 or later (affected >= 2.61.0, < 2.61.5)
  • librsvg 2.62.4Fixed version · GitHub Advisories · rust package librsvg: upgrade to 2.62.4 or later (affected >= 2.62.0-beta.0, < 2.62.4)
  • librsvg 2.63.2Fixed version · GitHub Advisories · rust package librsvg: upgrade to 2.63.2 or later (affected >= 2.63.0-beta.0, < 2.63.2)

[ Advisories ]Government CERT advisories

[ Packages ]Affected open-source packages

[ References ]References