# CVE-2026-96889: Librsvg: use-after-free when xml includes have duplicated entities

CVE-2026-96889 is fixed in 11 products on 1 platform, first by RHSA-2026:92214, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-96889
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0056
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 23, 2026
- Weakness: Use After Free
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96889

## Description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gir1.2-rsvg-2.0 Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [gir1.2-rsvg-2.0 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gir1.2-rsvg-2.0-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | gir1.2-rsvg-2.0 Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [gir1.2-rsvg-2.0 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gir1.2-rsvg-2.0-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | glycin-loaders RHEL 10 | 1.0.1-1.el10_0.1 | [RHSA-2026:92573](https://patchblox.com/security/data/fix/linux/rhsa-2026-92573.md) | Oct 21, 2026 |
| Linux | glycin-loaders almalinux 10 | 1.0.1-1.el10_2.2 | [ALSA-2026:86331](https://patchblox.com/security/data/fix/linux/alsa-2026-86331.md) | Nov 7, 2026 |
| Linux | glycin-loaders ol 10 | 0:1.0.1-1.el10_2.2 | [ELSA-2026-86331](https://patchblox.com/security/data/fix/linux/elsa-2026-86331.md) | Nov 7, 2026 |
| Linux | glycin-loaders rocky 10 | 0:1.0.1-1.el10_2.2 | [RLSA-2026:86331](https://patchblox.com/security/data/fix/linux/rlsa-2026-86331.md) | Nov 7, 2026 |
| Linux | librsvg Debian 13.5 (trixie) | 2.60.0+dfsg-1+deb13u1 | [DEBIAN-CVE-2026-96889](https://patchblox.com/security/data/fix/linux/debian-cve-2026-96889.md) | Oct 9, 2026 |
| Linux | librsvg Debian 14 | 2.63.2+dfsg-1 | [DEBIAN-CVE-2026-96889](https://patchblox.com/security/data/fix/linux/debian-cve-2026-96889.md) | Oct 9, 2026 |
| Linux | librsvg opensuse-leap 16.0 | 2.60.3-160000.1.1 | [OPENSUSE-SU-2026:22051-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22051-1.md) | Nov 7, 2026 |
| Linux | librsvg sles 16.0 | 2.60.3-160000.1.1 | [SUSE-SU-2026:24202-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24202-1.md) | Nov 7, 2026 |
| Linux | librsvg2 RHEL 10 | 2.57.1-9.el10_0.1 | [RHSA-2026:92214](https://patchblox.com/security/data/fix/linux/rhsa-2026-92214.md) | Sep 23, 2026 |
| Linux | librsvg2 RHEL 8 | 0:2.42.7-6.el8_10 | [RHSA-2026:86842](https://patchblox.com/security/data/fix/linux/rhsa-2026-86842.md) | Oct 21, 2026 |
| Linux | librsvg2 RHEL 9 | 0:2.50.7-3.el9_8.1 | [RHSA-2026:86921](https://patchblox.com/security/data/fix/linux/rhsa-2026-86921.md) | Oct 24, 2026 |
| Linux | librsvg2 almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2 almalinux 8 | 2.42.7-6.el8_10 | [ALSA-2026:86842](https://patchblox.com/security/data/fix/linux/alsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2 almalinux 9 | 2.50.7-3.el9_8.1 | [ALSA-2026:86921](https://patchblox.com/security/data/fix/linux/alsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2 ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2 ol 8 | 0:2.42.7-6.el8_10 | [ELSA-2026-86842](https://patchblox.com/security/data/fix/linux/elsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2 ol 9 | 0:2.50.7-3.el9_8.1 | [ELSA-2026-86921](https://patchblox.com/security/data/fix/linux/elsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2 rocky 10 | 0:2.57.1-9.el10_2.10 | [RLSA-2026:86841](https://patchblox.com/security/data/fix/linux/rlsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2 rocky 8 | 0:2.42.7-6.el8_10 | [RLSA-2026:86842](https://patchblox.com/security/data/fix/linux/rlsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2 rocky 9 | 0:2.50.7-3.el9_8.1 | [RLSA-2026:86921](https://patchblox.com/security/data/fix/linux/rlsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-2 Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-2 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-2-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-2 Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-2 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-2-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-bin Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-bin 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-bin-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-bin Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-bin 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-bin-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-common Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-common 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-common-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-common Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-common 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-common-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-devel RHEL 8 | 0:2.42.7-6.el8_10 | [RHSA-2026:86842](https://patchblox.com/security/data/fix/linux/rhsa-2026-86842.md) | Oct 21, 2026 |
| Linux | librsvg2-devel RHEL 9 | 0:2.50.7-3.el9_8.1 | [RHSA-2026:86921](https://patchblox.com/security/data/fix/linux/rhsa-2026-86921.md) | Oct 24, 2026 |
| Linux | librsvg2-devel almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-devel almalinux 8 | 2.42.7-6.el8_10 | [ALSA-2026:86842](https://patchblox.com/security/data/fix/linux/alsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-devel almalinux 9 | 2.50.7-3.el9_8.1 | [ALSA-2026:86921](https://patchblox.com/security/data/fix/linux/alsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-devel ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-devel ol 8 | 0:2.42.7-6.el8_10 | [ELSA-2026-86842](https://patchblox.com/security/data/fix/linux/elsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-devel ol 9 | 0:2.50.7-3.el9_8.1 | [ELSA-2026-86921](https://patchblox.com/security/data/fix/linux/elsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-tests Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-tests 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-tests-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-tests Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-tests 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-tests-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-tools RHEL 8 | 0:2.42.7-6.el8_10 | [RHSA-2026:86842](https://patchblox.com/security/data/fix/linux/rhsa-2026-86842.md) | Oct 21, 2026 |
| Linux | librsvg2-tools RHEL 9 | 0:2.50.7-3.el9_8.1 | [RHSA-2026:86921](https://patchblox.com/security/data/fix/linux/rhsa-2026-86921.md) | Oct 24, 2026 |
| Linux | librsvg2-tools almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-tools almalinux 8 | 2.42.7-6.el8_10 | [ALSA-2026:86842](https://patchblox.com/security/data/fix/linux/alsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-tools almalinux 9 | 2.50.7-3.el9_8.1 | [ALSA-2026:86921](https://patchblox.com/security/data/fix/linux/alsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-tools ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-tools ol 8 | 0:2.42.7-6.el8_10 | [ELSA-2026-86842](https://patchblox.com/security/data/fix/linux/elsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-tools ol 9 | 0:2.50.7-3.el9_8.1 | [ELSA-2026-86921](https://patchblox.com/security/data/fix/linux/elsa-2026-86921.md) | Nov 7, 2026 |
| Linux | rsvg-pixbuf-loader almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | rsvg-pixbuf-loader ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo