Summary
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | librsvg2 | 2.57.1-9.el10_2.10 |
| AlmaLinux · 10 | librsvg2-devel | 2.57.1-9.el10_2.10 |
| AlmaLinux · 10 | librsvg2-tools | 2.57.1-9.el10_2.10 |
| AlmaLinux · 10 | rsvg-pixbuf-loader | 2.57.1-9.el10_2.10 |
Vulnerabilities 1
-
High 7.8CVE-2026-96889 Public exploit
Librsvg: use-after-free when xml includes have duplicated entities
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that …