High ELSA-2026-86842 1 CVE

Important: librsvg2 security update (Oracle Linux 8)

Published Oct 21, 2026 · Updated Oct 21, 2026

Ecosystem: Oracle Linux

Summary

[2.42.7-6]
- CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities
duplicated entities
- Resolves: RHEL-267981

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 8	librsvg2	0:2.42.7-6.el8_10
Oracle Linux · 8	librsvg2-devel	0:2.42.7-6.el8_10
Oracle Linux · 8	librsvg2-tools	0:2.42.7-6.el8_10

Vulnerabilities 1

High 7.8

CVE-2026-96889 Public exploit

Librsvg: use-after-free when xml includes have duplicated entities

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux crates.io

Sep 23, 2026