Critical Use-After-Free Vulnerability in librsvg2 Package
Summary
RLSA-2026:86841: Important: librsvg2 security update. Affects librsvg2 versions < 0:2.57.1-9.el10_2.10. Fixed in 0:2.57.1-9.el10_2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The librsvg2 package is a Scalable Vector Graphics (SVG) library that is based on the libart library. It is widely used for rendering SVG files in various applications, providing essential functionality for graphical representation. However, it is susceptible to a significant security vulnerability that can lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2026-96889 is a use-after-free issue that occurs when XML includes have duplicated entities. This flaw can allow an attacker to manipulate memory, potentially leading to arbitrary code execution or application crashes. The ramifications of this vulnerability are critical, as it can compromise the integrity and confidentiality of the system utilizing the librsvg2 library.
How To Fix
Minimum fixed version
0:2.57.1-9.el10_2.10
This is the first release that contains the fix.
sudo dnf update librsvg2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The librsvg2 package is critical for rendering SVG files, but it is currently affected by a serious use-after-free vulnerability. Users are advised to update to the patched version to mitigate risks. Regular updates and monitoring for vulnerabilities are essential for maintaining system security.
See every vulnerability recorded for librsvg2 →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, leading to potential memory corruption and security risks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without requiring access to the code.
Exploitation of this vulnerability could lead to arbitrary code execution, application crashes, and compromise of system integrity and confidentiality.
Yes, the CVSS score for this vulnerability is 7.8, indicating a high level of severity.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for librsvg2.
