{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96889.json"
      }
    ],
    "title": "librsvg: Use-after-free when XML includes have duplicated entities",
    "tracking": {
      "current_release_date": "2026-09-23T20:02:32+00:00",
      "generator": {
        "date": "2026-09-23T20:02:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "CVE-2026-96889",
      "initial_release_date": "2026-09-23T12:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-09-23T12:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-23T19:51:24+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-09-23T20:02:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 10",
                "product": {
                  "name": "Red Hat Enterprise Linux 10",
                  "product_id": "red_hat_enterprise_linux_10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 10"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 6",
                "product": {
                  "name": "Red Hat Enterprise Linux 6",
                  "product_id": "red_hat_enterprise_linux_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 6"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 7",
                "product": {
                  "name": "Red Hat Enterprise Linux 7",
                  "product_id": "red_hat_enterprise_linux_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 8",
                "product": {
                  "name": "Red Hat Enterprise Linux 8",
                  "product_id": "red_hat_enterprise_linux_8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 8"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 9",
                "product": {
                  "name": "Red Hat Enterprise Linux 9",
                  "product_id": "red_hat_enterprise_linux_9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux 9"
          },
          {
            "category": "product_version",
            "name": "glycin-loaders.src",
            "product": {
              "name": "glycin-loaders.src",
              "product_id": "glycin-loaders.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/glycin-loaders?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "librsvg2.src",
            "product": {
              "name": "librsvg2.src",
              "product_id": "librsvg2.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/librsvg2?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rsvg-pixbuf-loader",
            "product": {
              "name": "rsvg-pixbuf-loader",
              "product_id": "rsvg-pixbuf-loader",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/rsvg-pixbuf-loader"
              }
            }
          },
          {
            "category": "product_version",
            "name": "librsvg2-devel",
            "product": {
              "name": "librsvg2-devel",
              "product_id": "librsvg2-devel",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/librsvg2-devel"
              }
            }
          },
          {
            "category": "product_version",
            "name": "librsvg2-tools",
            "product": {
              "name": "librsvg2-tools",
              "product_id": "librsvg2-tools",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/librsvg2-tools"
              }
            }
          },
          {
            "category": "product_version",
            "name": "librsvg2",
            "product": {
              "name": "librsvg2",
              "product_id": "librsvg2",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/librsvg2"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glycin-loaders.src as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:glycin-loaders.src"
        },
        "product_reference": "glycin-loaders.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-devel as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:librsvg2-devel"
        },
        "product_reference": "librsvg2-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-tools as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:librsvg2-tools"
        },
        "product_reference": "librsvg2-tools",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2.src as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:librsvg2.src"
        },
        "product_reference": "librsvg2.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsvg-pixbuf-loader as a component of Red Hat Enterprise Linux 10",
          "product_id": "red_hat_enterprise_linux_10:rsvg-pixbuf-loader"
        },
        "product_reference": "rsvg-pixbuf-loader",
        "relates_to_product_reference": "red_hat_enterprise_linux_10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2 as a component of Red Hat Enterprise Linux 6",
          "product_id": "red_hat_enterprise_linux_6:librsvg2"
        },
        "product_reference": "librsvg2",
        "relates_to_product_reference": "red_hat_enterprise_linux_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-devel as a component of Red Hat Enterprise Linux 6",
          "product_id": "red_hat_enterprise_linux_6:librsvg2-devel"
        },
        "product_reference": "librsvg2-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2.src as a component of Red Hat Enterprise Linux 6",
          "product_id": "red_hat_enterprise_linux_6:librsvg2.src"
        },
        "product_reference": "librsvg2.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2 as a component of Red Hat Enterprise Linux 7",
          "product_id": "red_hat_enterprise_linux_7:librsvg2"
        },
        "product_reference": "librsvg2",
        "relates_to_product_reference": "red_hat_enterprise_linux_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-devel as a component of Red Hat Enterprise Linux 7",
          "product_id": "red_hat_enterprise_linux_7:librsvg2-devel"
        },
        "product_reference": "librsvg2-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-tools as a component of Red Hat Enterprise Linux 7",
          "product_id": "red_hat_enterprise_linux_7:librsvg2-tools"
        },
        "product_reference": "librsvg2-tools",
        "relates_to_product_reference": "red_hat_enterprise_linux_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2.src as a component of Red Hat Enterprise Linux 7",
          "product_id": "red_hat_enterprise_linux_7:librsvg2.src"
        },
        "product_reference": "librsvg2.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2 as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:librsvg2"
        },
        "product_reference": "librsvg2",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-devel as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:librsvg2-devel"
        },
        "product_reference": "librsvg2-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-tools as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:librsvg2-tools"
        },
        "product_reference": "librsvg2-tools",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2.src as a component of Red Hat Enterprise Linux 8",
          "product_id": "red_hat_enterprise_linux_8:librsvg2.src"
        },
        "product_reference": "librsvg2.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2 as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:librsvg2"
        },
        "product_reference": "librsvg2",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-devel as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:librsvg2-devel"
        },
        "product_reference": "librsvg2-devel",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2-tools as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:librsvg2-tools"
        },
        "product_reference": "librsvg2-tools",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "librsvg2.src as a component of Red Hat Enterprise Linux 9",
          "product_id": "red_hat_enterprise_linux_9:librsvg2.src"
        },
        "product_reference": "librsvg2.src",
        "relates_to_product_reference": "red_hat_enterprise_linux_9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Rafael B. Dias"
          ]
        }
      ],
      "cve": "CVE-2026-96889",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-23T09:29:12.429665+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539279"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "librsvg: Use-after-free when XML includes have duplicated entities",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important use-after-free flaw in librsvg, which could lead to arbitrary code execution or denial of service. The vulnerability occurs when processing a specially crafted SVG document containing nested Xincludes with duplicated XML entity declarations. Exploitation requires user interaction, such as opening a malicious SVG file. The issue has been fixed upstream in version 2.63.1.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_enterprise_linux_10:glycin-loaders.src",
          "red_hat_enterprise_linux_10:librsvg2-devel",
          "red_hat_enterprise_linux_10:librsvg2-tools",
          "red_hat_enterprise_linux_10:librsvg2.src",
          "red_hat_enterprise_linux_10:rsvg-pixbuf-loader",
          "red_hat_enterprise_linux_6:librsvg2",
          "red_hat_enterprise_linux_6:librsvg2-devel",
          "red_hat_enterprise_linux_6:librsvg2.src",
          "red_hat_enterprise_linux_7:librsvg2",
          "red_hat_enterprise_linux_7:librsvg2-devel",
          "red_hat_enterprise_linux_7:librsvg2-tools",
          "red_hat_enterprise_linux_7:librsvg2.src",
          "red_hat_enterprise_linux_8:librsvg2",
          "red_hat_enterprise_linux_8:librsvg2-devel",
          "red_hat_enterprise_linux_8:librsvg2-tools",
          "red_hat_enterprise_linux_8:librsvg2.src",
          "red_hat_enterprise_linux_9:librsvg2",
          "red_hat_enterprise_linux_9:librsvg2-devel",
          "red_hat_enterprise_linux_9:librsvg2-tools",
          "red_hat_enterprise_linux_9:librsvg2.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-96889"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539279",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539279"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-96889",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96889"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96889",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96889"
        },
        {
          "category": "external",
          "summary": "https://crates.io/crates/librsvg",
          "url": "https://crates.io/crates/librsvg"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241",
          "url": "https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241"
        },
        {
          "category": "external",
          "summary": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html",
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0305.html"
        }
      ],
      "release_date": "2026-09-23T12:00:00+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "red_hat_enterprise_linux_10:glycin-loaders.src",
            "red_hat_enterprise_linux_10:librsvg2-devel",
            "red_hat_enterprise_linux_10:librsvg2-tools",
            "red_hat_enterprise_linux_10:librsvg2.src",
            "red_hat_enterprise_linux_10:rsvg-pixbuf-loader",
            "red_hat_enterprise_linux_6:librsvg2",
            "red_hat_enterprise_linux_6:librsvg2-devel",
            "red_hat_enterprise_linux_6:librsvg2.src",
            "red_hat_enterprise_linux_7:librsvg2",
            "red_hat_enterprise_linux_7:librsvg2-devel",
            "red_hat_enterprise_linux_7:librsvg2-tools",
            "red_hat_enterprise_linux_7:librsvg2.src",
            "red_hat_enterprise_linux_8:librsvg2",
            "red_hat_enterprise_linux_8:librsvg2-devel",
            "red_hat_enterprise_linux_8:librsvg2-tools",
            "red_hat_enterprise_linux_8:librsvg2.src",
            "red_hat_enterprise_linux_9:librsvg2",
            "red_hat_enterprise_linux_9:librsvg2-devel",
            "red_hat_enterprise_linux_9:librsvg2-tools",
            "red_hat_enterprise_linux_9:librsvg2.src"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "red_hat_enterprise_linux_6:librsvg2",
            "red_hat_enterprise_linux_6:librsvg2-devel",
            "red_hat_enterprise_linux_6:librsvg2.src"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "red_hat_enterprise_linux_10:glycin-loaders.src",
            "red_hat_enterprise_linux_10:librsvg2-devel",
            "red_hat_enterprise_linux_10:librsvg2-tools",
            "red_hat_enterprise_linux_10:librsvg2.src",
            "red_hat_enterprise_linux_10:rsvg-pixbuf-loader",
            "red_hat_enterprise_linux_7:librsvg2",
            "red_hat_enterprise_linux_7:librsvg2-devel",
            "red_hat_enterprise_linux_7:librsvg2-tools",
            "red_hat_enterprise_linux_7:librsvg2.src",
            "red_hat_enterprise_linux_8:librsvg2",
            "red_hat_enterprise_linux_8:librsvg2-devel",
            "red_hat_enterprise_linux_8:librsvg2-tools",
            "red_hat_enterprise_linux_8:librsvg2.src",
            "red_hat_enterprise_linux_9:librsvg2",
            "red_hat_enterprise_linux_9:librsvg2-devel",
            "red_hat_enterprise_linux_9:librsvg2-tools",
            "red_hat_enterprise_linux_9:librsvg2.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "red_hat_enterprise_linux_10:glycin-loaders.src",
            "red_hat_enterprise_linux_10:librsvg2-devel",
            "red_hat_enterprise_linux_10:librsvg2-tools",
            "red_hat_enterprise_linux_10:librsvg2.src",
            "red_hat_enterprise_linux_10:rsvg-pixbuf-loader",
            "red_hat_enterprise_linux_6:librsvg2",
            "red_hat_enterprise_linux_6:librsvg2-devel",
            "red_hat_enterprise_linux_6:librsvg2.src",
            "red_hat_enterprise_linux_7:librsvg2",
            "red_hat_enterprise_linux_7:librsvg2-devel",
            "red_hat_enterprise_linux_7:librsvg2-tools",
            "red_hat_enterprise_linux_7:librsvg2.src",
            "red_hat_enterprise_linux_8:librsvg2",
            "red_hat_enterprise_linux_8:librsvg2-devel",
            "red_hat_enterprise_linux_8:librsvg2-tools",
            "red_hat_enterprise_linux_8:librsvg2.src",
            "red_hat_enterprise_linux_9:librsvg2",
            "red_hat_enterprise_linux_9:librsvg2-devel",
            "red_hat_enterprise_linux_9:librsvg2-tools",
            "red_hat_enterprise_linux_9:librsvg2.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "red_hat_enterprise_linux_10:glycin-loaders.src",
            "red_hat_enterprise_linux_10:librsvg2-devel",
            "red_hat_enterprise_linux_10:librsvg2-tools",
            "red_hat_enterprise_linux_10:librsvg2.src",
            "red_hat_enterprise_linux_10:rsvg-pixbuf-loader",
            "red_hat_enterprise_linux_6:librsvg2",
            "red_hat_enterprise_linux_6:librsvg2-devel",
            "red_hat_enterprise_linux_6:librsvg2.src",
            "red_hat_enterprise_linux_7:librsvg2",
            "red_hat_enterprise_linux_7:librsvg2-devel",
            "red_hat_enterprise_linux_7:librsvg2-tools",
            "red_hat_enterprise_linux_7:librsvg2.src",
            "red_hat_enterprise_linux_8:librsvg2",
            "red_hat_enterprise_linux_8:librsvg2-devel",
            "red_hat_enterprise_linux_8:librsvg2-tools",
            "red_hat_enterprise_linux_8:librsvg2.src",
            "red_hat_enterprise_linux_9:librsvg2",
            "red_hat_enterprise_linux_9:librsvg2-devel",
            "red_hat_enterprise_linux_9:librsvg2-tools",
            "red_hat_enterprise_linux_9:librsvg2.src"
          ]
        }
      ],
      "title": "librsvg: Use-after-free when XML includes have duplicated entities"
    }
  ]
}