CVE catalog

CVE-2026-96889

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Sep 23, 2026, 12:00:00 PM UTC
Updated: Sep 23, 2026, 8:17:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.53% · Oct 25, 2026

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	librsvg	sid	`2.63.3+dfsg-1`	fixed
Debian	librsvg	forky	`2.63.3+dfsg-1`	fixed
Debian	librsvg	trixie	`2.60.0+dfsg-1`	vulnerable
Debian	librsvg	trixie-security	`2.60.0+dfsg-1+deb13u1`	fixed
Debian	librsvg	bookworm	`2.54.7+dfsg-1~deb12u1`	vulnerable
Debian	librsvg	bookworm-security	`2.54.7+dfsg-1~deb12u1`	vulnerable
Ubuntu	librsvg	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	gir1.2-rsvg-2.0	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg2-2	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg2-bin	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg2-common	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg2-dev	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg2-doc	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg2-tests	noble	`2.58.0+dfsg-1ubuntu0.1`	fixed
Suse	librsvg	linux micro 6.2	`2.60.3-160000.1.1`	fixed
Ubuntu	librsvg	24.04	`2.54.7+dfsg-2`	vulnerable
Ubuntu	librsvg	24.04	`2.57.91+dfsg-2ubuntu1`	vulnerable
Ubuntu	librsvg	24.04	`2.58.0+dfsg-1build1`	vulnerable
Ubuntu	librsvg	24.04	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg	26.04	`2.60.0+dfsg-1build1`	vulnerable
Ubuntu	librsvg	26.04	`2.61.3+dfsg-2`	vulnerable
Ubuntu	librsvg	26.04	`2.61.3+dfsg-3`	vulnerable
Ubuntu	librsvg	26.04	`2.61.3+dfsg-3ubuntu0.1`	fixed
Ubuntu	librsvg	24.04	`2.54.7+dfsg-2`	vulnerable
Ubuntu	librsvg	24.04	`2.57.91+dfsg-2ubuntu1`	vulnerable
Ubuntu	librsvg	24.04	`2.58.0+dfsg-1build1`	vulnerable
Ubuntu	librsvg	24.04	`2.58.0+dfsg-1ubuntu0.1`	fixed
Ubuntu	librsvg	26.04	`2.60.0+dfsg-1build1`	vulnerable
Ubuntu	librsvg	26.04	`2.61.3+dfsg-2`	vulnerable
Ubuntu	librsvg	26.04	`2.61.3+dfsg-3`	vulnerable
Ubuntu	librsvg	26.04	`2.61.3+dfsg-3ubuntu0.1`	fixed
Suse	librsvg	linux enterprise server 16.0	`2.60.3-160000.1.1`	fixed
Suse	librsvg	linux enterprise server for sap applications 16.0	`2.60.3-160000.1.1`	fixed
Opensuse	librsvg	leap 16.0	`2.60.3-160000.1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	librsvg	source	sid	`2.63.2+dfsg-1`	not yet assigned	Not reported	[1148902]
Debian	librsvg	source	forky	`2.63.2+dfsg-1`	not yet assigned	Not reported	[1148902]
Debian	librsvg	source	trixie	`2.60.0+dfsg-1+deb13u1`	not yet assigned	Not reported	[1148902]
Debian	librsvg	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1148902]
Ubuntu	librsvg	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-rsvg-2.0	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	librsvg2-2	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	librsvg2-bin	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	librsvg2-common	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	librsvg2-dev	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	librsvg2-doc	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Ubuntu	librsvg2-tests	deb	noble	`2.58.0+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Suse	librsvg	rpm	linux micro 6.2	`2.60.3-160000.1.1`	Not reported	SUSE-SU-2026:24117-1	Not reported
Ubuntu	librsvg	deb	24.04	`2.58.0+dfsg-1ubuntu0.1`	Not reported	USN-8891-1	Not reported
Ubuntu	librsvg	deb	26.04	`2.61.3+dfsg-3ubuntu0.1`	Not reported	USN-8891-1	Not reported
Ubuntu	librsvg	deb	24.04	`2.58.0+dfsg-1ubuntu0.1`	Not reported	UBUNTU-CVE-2026-96889	Not reported
Ubuntu	librsvg	deb	26.04	`2.61.3+dfsg-3ubuntu0.1`	Not reported	UBUNTU-CVE-2026-96889	Not reported
Suse	librsvg	rpm	linux enterprise server 16.0	`2.60.3-160000.1.1`	Not reported	SUSE-SU-2026:24202-1	Not reported
Suse	librsvg	rpm	linux enterprise server for sap applications 16.0	`2.60.3-160000.1.1`	Not reported	SUSE-SU-2026:24202-1	Not reported
Opensuse	librsvg	rpm	leap 16.0	`2.60.3-160000.1.1`	Not reported	OPENSUSE-SU-2026:22051-1	Not reported

[Debian bug #1148902]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-rsvg-2.0]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
[librsvg2-2]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
[librsvg2-bin]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
[librsvg2-common]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
[librsvg2-dev]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
[librsvg2-doc]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · all · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · all · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · all · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · all · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
[librsvg2-tests]Affected
Source package: [librsvg]
Details (4)
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12
- 2.54.7+dfsg-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · librsvg · debian · bookworm; nvd · librsvg · debian · 12

[Debian 13 (Trixie)]

[gir1.2-rsvg-2.0]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · amd64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · arm64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
[librsvg2-2]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · amd64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · arm64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
[librsvg2-bin]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · amd64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · arm64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
[librsvg2-common]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · amd64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · arm64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
[librsvg2-dev]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · amd64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · arm64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
[librsvg2-doc]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · all · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · all · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
[librsvg2-tests]Affected
Source package: [librsvg]
Details (3)
- 2.60.0+dfsg-1 · amd64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1 · arm64 · trixie
  Affected · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13
- 2.60.0+dfsg-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.60.0+dfsg-1+deb13u1
  nvd · librsvg · debian · 13

Observed: Oct 27, 2026, 5:43:47 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]