# CVE-2026-96889: Librsvg: use-after-free when xml includes have duplicated entities

CVE-2026-96889 is fixed in 15 products on 1 platform, first by RHSA-2026:92214, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-96889
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0056
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 23, 2026
- Weakness: Use After Free
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96889

## Description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gir1.2-rsvg-2.0 Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [gir1.2-rsvg-2.0 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gir1.2-rsvg-2.0-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | gir1.2-rsvg-2.0 Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [gir1.2-rsvg-2.0 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gir1.2-rsvg-2.0-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | glycin-loaders RHEL 10 | 1.0.1-1.el10_0.1 | [RHSA-2026:92573](https://patchblox.com/security/data/fix/linux/rhsa-2026-92573.md) | Oct 21, 2026 |
| Linux | glycin-loaders almalinux 10 | 1.0.1-1.el10_2.2 | [ALSA-2026:86331](https://patchblox.com/security/data/fix/linux/alsa-2026-86331.md) | Nov 7, 2026 |
| Linux | glycin-loaders ol 10 | 0:1.0.1-1.el10_2.2 | [ELSA-2026-86331](https://patchblox.com/security/data/fix/linux/elsa-2026-86331.md) | Nov 7, 2026 |
| Linux | glycin-loaders rocky 10 | 0:1.0.1-1.el10_2.2 | [RLSA-2026:86331](https://patchblox.com/security/data/fix/linux/rlsa-2026-86331.md) | Nov 7, 2026 |
| Linux | librsvg Debian 13.5 (trixie) | 2.60.0+dfsg-1+deb13u1 | [DEBIAN-CVE-2026-96889](https://patchblox.com/security/data/fix/linux/debian-cve-2026-96889.md) | Oct 9, 2026 |
| Linux | librsvg Debian 14 | 2.63.2+dfsg-1 | [DEBIAN-CVE-2026-96889](https://patchblox.com/security/data/fix/linux/debian-cve-2026-96889.md) | Oct 9, 2026 |
| Linux | librsvg opensuse-leap 16.0 | 2.60.3-160000.1.1 | [OPENSUSE-SU-2026:22051-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22051-1.md) | Nov 7, 2026 |
| Linux | librsvg sles 16.0 | 2.60.3-160000.1.1 | [SUSE-SU-2026:24202-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24202-1.md) | Nov 7, 2026 |
| Linux | librsvg2 RHEL 10 | 2.57.1-9.el10_0.1 | [RHSA-2026:92214](https://patchblox.com/security/data/fix/linux/rhsa-2026-92214.md) | Sep 23, 2026 |
| Linux | librsvg2 RHEL 8 | 0:2.42.7-6.el8_10 | [RHSA-2026:86842](https://patchblox.com/security/data/fix/linux/rhsa-2026-86842.md) | Oct 21, 2026 |
| Linux | librsvg2 RHEL 9 | 0:2.50.7-3.el9_8.1 | [RHSA-2026:86921](https://patchblox.com/security/data/fix/linux/rhsa-2026-86921.md) | Oct 24, 2026 |
| Linux | librsvg2 almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2 almalinux 8 | 2.42.7-6.el8_10 | [ALSA-2026:86842](https://patchblox.com/security/data/fix/linux/alsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2 almalinux 9 | 2.50.7-3.el9_8.1 | [ALSA-2026:86921](https://patchblox.com/security/data/fix/linux/alsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2 amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | librsvg2 ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2 ol 8 | 0:2.42.7-6.el8_10 | [ELSA-2026-86842](https://patchblox.com/security/data/fix/linux/elsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2 ol 9 | 0:2.50.7-3.el9_8.1 | [ELSA-2026-86921](https://patchblox.com/security/data/fix/linux/elsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2 rocky 10 | 0:2.57.1-9.el10_2.10 | [RLSA-2026:86841](https://patchblox.com/security/data/fix/linux/rlsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2 rocky 8 | 0:2.42.7-6.el8_10 | [RLSA-2026:86842](https://patchblox.com/security/data/fix/linux/rlsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2 rocky 9 | 0:2.50.7-3.el9_8.1 | [RLSA-2026:86921](https://patchblox.com/security/data/fix/linux/rlsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-2 Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-2 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-2-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-2 Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-2 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-2-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-bin Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-bin 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-bin-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-bin Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-bin 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-bin-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-common Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-common 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-common-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-common Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-common 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-common-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-debuginfo amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | librsvg2-debugsource amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | librsvg2-devel RHEL 8 | 0:2.42.7-6.el8_10 | [RHSA-2026:86842](https://patchblox.com/security/data/fix/linux/rhsa-2026-86842.md) | Oct 21, 2026 |
| Linux | librsvg2-devel RHEL 9 | 0:2.50.7-3.el9_8.1 | [RHSA-2026:86921](https://patchblox.com/security/data/fix/linux/rhsa-2026-86921.md) | Oct 24, 2026 |
| Linux | librsvg2-devel almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-devel almalinux 8 | 2.42.7-6.el8_10 | [ALSA-2026:86842](https://patchblox.com/security/data/fix/linux/alsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-devel almalinux 9 | 2.50.7-3.el9_8.1 | [ALSA-2026:86921](https://patchblox.com/security/data/fix/linux/alsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-devel amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | librsvg2-devel ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-devel ol 8 | 0:2.42.7-6.el8_10 | [ELSA-2026-86842](https://patchblox.com/security/data/fix/linux/elsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-devel ol 9 | 0:2.50.7-3.el9_8.1 | [ELSA-2026-86921](https://patchblox.com/security/data/fix/linux/elsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-tests Ubuntu 24.04.5 LTS (noble) | 2.58.0+dfsg-1ubuntu0.1 | [librsvg2-tests 2.58.0+dfsg-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-librsvg2-tests-2.58.0-dfsg-1ubuntu0.1.md) | Oct 7, 2026 |
| Linux | librsvg2-tests Ubuntu 26.04.1 LTS (resolute) | 2.61.3+dfsg-3ubuntu0.1 | [librsvg2-tests 2.61.3+dfsg-3ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-librsvg2-tests-2.61.3-dfsg-3ubuntu0.1.md) | Sep 23, 2026 |
| Linux | librsvg2-tools RHEL 8 | 0:2.42.7-6.el8_10 | [RHSA-2026:86842](https://patchblox.com/security/data/fix/linux/rhsa-2026-86842.md) | Oct 21, 2026 |
| Linux | librsvg2-tools RHEL 9 | 0:2.50.7-3.el9_8.1 | [RHSA-2026:86921](https://patchblox.com/security/data/fix/linux/rhsa-2026-86921.md) | Oct 24, 2026 |
| Linux | librsvg2-tools almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-tools almalinux 8 | 2.42.7-6.el8_10 | [ALSA-2026:86842](https://patchblox.com/security/data/fix/linux/alsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-tools almalinux 9 | 2.50.7-3.el9_8.1 | [ALSA-2026:86921](https://patchblox.com/security/data/fix/linux/alsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-tools amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | librsvg2-tools ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | librsvg2-tools ol 8 | 0:2.42.7-6.el8_10 | [ELSA-2026-86842](https://patchblox.com/security/data/fix/linux/elsa-2026-86842.md) | Nov 7, 2026 |
| Linux | librsvg2-tools ol 9 | 0:2.50.7-3.el9_8.1 | [ELSA-2026-86921](https://patchblox.com/security/data/fix/linux/elsa-2026-86921.md) | Nov 7, 2026 |
| Linux | librsvg2-tools-debuginfo amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | rsvg-pixbuf-loader almalinux 10 | 2.57.1-9.el10_2.10 | [ALSA-2026:86841](https://patchblox.com/security/data/fix/linux/alsa-2026-86841.md) | Nov 7, 2026 |
| Linux | rsvg-pixbuf-loader amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |
| Linux | rsvg-pixbuf-loader ol 10 | 0:2.57.1-9.el10_2.10 | [ELSA-2026-86841](https://patchblox.com/security/data/fix/linux/elsa-2026-86841.md) | Nov 7, 2026 |
| Linux | rsvg-pixbuf-loader-debuginfo amzn 2023 | 2.59.2-320.amzn2023 | [ALAS2023-2026-3392](https://patchblox.com/security/data/fix/linux/alas2023-2026-3392.md) | Nov 10, 2026 |

---

Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.