Summary
[2.50.7-3.1]
- CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities
entities
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | librsvg2 | 0:2.50.7-3.el9_8.1 |
| Oracle Linux · 9 | librsvg2-devel | 0:2.50.7-3.el9_8.1 |
| Oracle Linux · 9 | librsvg2-tools | 0:2.50.7-3.el9_8.1 |
Vulnerabilities 1
-
High 7.8CVE-2026-96889 Public exploit
Librsvg: use-after-free when xml includes have duplicated entities
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that …