ALSA-2026:86921: Use-after-free in librsvg2 when XML entities are duplicated
Summary
ALSA-2026:86921: Duplicated XML entities in SVG includes can trigger a use-after-free, potentially disrupting applications that process the affected content. Affects librsvg2 versions < 2.50.7-3.el9_8.1. Fixed in 2.50.7-3.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
librsvg2 is an SVG library in the AlmaLinux:9 ecosystem. It provides Scalable Vector Graphics processing and is used by applications that need to handle SVG content. The advisory also covers the librsvg2-devel and librsvg2-tools packages, which are distributed alongside the library in this ecosystem.
Vulnerability Detail
Processing SVG content with XML includes containing duplicated entities can cause a use-after-free in librsvg. This memory-safety flaw may lead to application crashes or other unintended behavior while handling crafted input. The advisory identifies the issue as CVE-2026-96889 and RUSTSEC-2026-0305. The supplied record does not publish a CVSS score or further impact details.
How To Fix
Minimum fixed version
2.50.7-3.el9_8.1
This is the first release that contains the fix.
sudo dnf update librsvg2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict librsvg2 processing to trusted SVG files and reject documents containing XML includes until the affected packages are upgraded.
Conclusion
Upgrade the affected packages to the minimum fixed version 2.50.7-3.el9_8.1. The advisory covers the library, development files, and tools in the AlmaLinux:9 ecosystem. Review package inventories and manifests to identify deployments that include these components. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for librsvg2 →
FAQ
The librsvg2, librsvg2-devel, and librsvg2-tools packages are affected before the fixed version 2.50.7-3.el9_8.1.
CVE-2026-96889 can trigger a use-after-free when librsvg processes XML includes with duplicated entities, potentially disrupting applications.
Upgrade the affected librsvg2 packages to the minimum fixed version 2.50.7-3.el9_8.1.
Restrict librsvg2 processing to trusted SVG files and reject documents containing XML includes until you can upgrade.
Check the installed package inventory or application manifest for librsvg2, librsvg2-devel, or librsvg2-tools. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for librsvg2.
