Critical Use-After-Free Vulnerability in librsvg2 Package
Summary
RLSA-2026:86842: Important: librsvg2 security update. Affects librsvg2 versions < 0:2.42.7-6.el8_10. Fixed in 0:2.42.7-6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
librsvg2 is a library that provides support for rendering Scalable Vector Graphics (SVG) files, built on the libart library. It is widely used in various applications for handling SVG content due to its efficiency and versatility. However, it has been identified to have a critical vulnerability that can lead to severe security issues if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2026-96889 is a use-after-free issue that occurs when XML includes have duplicated entities. This flaw can allow an attacker to manipulate memory, potentially leading to arbitrary code execution or application crashes. The ramifications of this vulnerability are significant, as it can compromise the integrity and confidentiality of the affected systems.
How To Fix
Minimum fixed version
0:2.42.7-6.el8_10
This is the first release that contains the fix.
sudo dnf update librsvg2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing SVG files that may contain duplicated entities until the package is updated. This can help mitigate the risk of exploitation until a permanent fix is applied.
Conclusion
The librsvg2 package has a critical vulnerability (CVE-2026-96889) that can lead to severe security issues. It is essential to update to the patched version to mitigate risks. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert, which can provide real-time alerts based on manifest files.
See every vulnerability recorded for librsvg2 →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to arbitrary code execution, application crashes, and potential data breaches.
Yes, the patched version of librsvg2 is 0:2.42.7-6.el8_10, which resolves the use-after-free issue.
If immediate updates are not possible, refrain from using SVG files that may contain duplicated entities as a temporary measure to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for librsvg2.
