Summary
It was discovered that librsvg incorrectly handled duplicate XML entity
declarations while processing SVG documents containing nested XML
inclusions. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | librsvg | 2.58.0+dfsg-1ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | librsvg | 2.61.3+dfsg-3ubuntu0.1 |
Vulnerabilities 1
-
High 7.8CVE-2026-96889 Public exploit
Librsvg: use-after-free when xml includes have duplicated entities
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that …
References
-
report
https://ubuntu.com/security/CVE-2026-96889