High ELSA-2026-86841 1 CVE

Important: librsvg2 security update (Oracle Linux 10)

Published Oct 21, 2026 · Updated Oct 21, 2026

Ecosystem: Oracle Linux

Summary

[2.57.1-10]
- CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated
entities

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 10	librsvg2	0:2.57.1-9.el10_2.10
Oracle Linux · 10	librsvg2-devel	0:2.57.1-9.el10_2.10
Oracle Linux · 10	librsvg2-tools	0:2.57.1-9.el10_2.10
Oracle Linux · 10	rsvg-pixbuf-loader	0:2.57.1-9.el10_2.10

Vulnerabilities 1

High 7.8

CVE-2026-96889 Public exploit

Librsvg: use-after-free when xml includes have duplicated entities

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux crates.io

Sep 23, 2026