CVE-2026-96889

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 0.56%
EPSS Percentile: 46.89%
CISA KEV: Not listed

Description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 24-Sep-2026 03:17
Last Modified: 05-Nov-2026 08:17
EPSS Date: 2026-10-31
CWE: CWE-416

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Red Hat · Red Hat Enterprise Linux 10 Source: CNA · [email protected]
Default status: affected

0:1.0.1-1.el10_2.2 ≤ version < * — unaffected (rpm)

CPEs: cpe:/o:redhat:enterprise_linux:10.2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: glycin-loaders
Red Hat · Red Hat Enterprise Linux 10 Source: CNA · [email protected]
Default status: affected

0:2.57.1-9.el10_2.10 ≤ version < * — unaffected (rpm)

CPEs: cpe:/o:redhat:enterprise_linux:10.2

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support Source: CNA · [email protected]
Default status: affected

0:1.0.1-1.el10_0.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/o:redhat:enterprise_linux_eus:10.0

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: glycin-loaders
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support Source: CNA · [email protected]
Default status: affected

0:2.57.1-9.el10_0.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/o:redhat:enterprise_linux_eus:10.0

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 6 Source: CNA · [email protected]
Default status: unknown

CPEs: cpe:/o:redhat:rhel_els:6

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support Source: CNA · [email protected]
Default status: affected

0:2.40.20-1.el7_9.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/o:redhat:rhel_els:7

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8 Source: CNA · [email protected]
Default status: affected

0:2.42.7-6.el8_10 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:enterprise_linux:8::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Source: CNA · [email protected]
Default status: affected

0:2.42.7-4.el8_4.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_aus:8.4::appstream, cpe:/a:redhat:rhel_eus_long_life:8.4::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Source: CNA · [email protected]
Default status: affected

0:2.42.7-4.el8_4.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_aus:8.4::appstream, cpe:/a:redhat:rhel_eus_long_life:8.4::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Source: CNA · [email protected]
Default status: affected

0:2.42.7-4.el8_6.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_aus:8.6::appstream, cpe:/a:redhat:rhel_eus_long_life:8.6::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Source: CNA · [email protected]
Default status: affected

0:2.42.7-4.el8_6.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_aus:8.6::appstream, cpe:/a:redhat:rhel_eus_long_life:8.6::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service Source: CNA · [email protected]
Default status: affected

0:2.42.7-4.el8_8.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_e4s:8.8::appstream, cpe:/a:redhat:rhel_tus:8.8::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Source: CNA · [email protected]
Default status: affected

0:2.42.7-4.el8_8.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_e4s:8.8::appstream, cpe:/a:redhat:rhel_tus:8.8::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 9 Source: CNA · [email protected]
Default status: affected

0:2.50.7-3.el9_8.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:enterprise_linux:9::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Source: CNA · [email protected]
Default status: affected

0:2.50.7-1.el9_2.2 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_e4s:9.2::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Source: CNA · [email protected]
Default status: affected

0:2.50.7-3.el9_4.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_e4s:9.4::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support Source: CNA · [email protected]
Default status: affected

0:2.50.7-3.el9_6.1 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:rhel_eus:9.6::appstream

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: librsvg2
Red Hat · Red Hat Enterprise Linux AI (RHEL AI) 3 Source: CNA · [email protected]
Default status: affected

CPEs: cpe:/a:redhat:enterprise_linux_ai:3

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhelai3/bootc-cuda-rhel9
Red Hat · Red Hat Enterprise Linux AI (RHEL AI) 3 Source: CNA · [email protected]
Default status: affected

CPEs: cpe:/a:redhat:enterprise_linux_ai:3

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhelai3/bootc-gaudi-rhel9
Red Hat · Red Hat Enterprise Linux AI (RHEL AI) 3 Source: CNA · [email protected]
Default status: affected

CPEs: cpe:/a:redhat:enterprise_linux_ai:3

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhelai3/bootc-rocm-rhel9
Red Hat · Red Hat Enterprise Linux AI (RHEL AI) 3 Source: CNA · [email protected]
Default status: affected

CPEs: cpe:/a:redhat:enterprise_linux_ai:3

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhelai3/disk-image-cuda-rhel9
Red Hat · Red Hat OpenShift AI (RHOAI) Source: CNA · [email protected]
Default status: affected

CPEs: cpe:/a:redhat:openshift_ai

collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhoai/odh-feature-server-rhel9
Red Hat · Red Hat OpenShift AI 3.0 Source: CNA · [email protected]
Default status: affected

1793329709 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.0::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cpu-rhel9
Red Hat · Red Hat OpenShift AI 3.0 Source: CNA · [email protected]
Default status: affected

1793328358 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.0::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cuda-rhel9
Red Hat · Red Hat OpenShift AI 3.0 Source: CNA · [email protected]
Default status: affected

1793329305 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.0::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-rocm-rhel9
Red Hat · Red Hat OpenShift AI 3.0 Source: CNA · [email protected]
Default status: affected

1793327611 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.0::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-spyre-rhel9
Red Hat · Red Hat OpenShift AI 3.0 Source: CNA · [email protected]
Default status: affected

1793329706 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.0::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-tpu-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793327311 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cpu-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793326796 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cuda-12.9-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793326837 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cuda-13.0-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793327499 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-gaudi-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793329624 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-neuron-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793329011 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-rocm-6.4-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793330096 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-rocm-7.1-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793326217 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-spyre-rhel9
Red Hat · Red Hat OpenShift AI 3.4 Source: CNA · [email protected]
Default status: affected

1793330461 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.4::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-tpu-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793330940 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cpu-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793327660 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cuda-12.9-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793329271 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-cuda-13.0-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793327512 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-gaudi-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793326392 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-neuron-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793326530 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-rocm-7.14-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793329296 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-rubin-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793330882 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-spyre-rhel9
Red Hat · Red Hat OpenShift AI 3.5 Source: CNA · [email protected]
Default status: affected

1793328643 ≤ version < * — unaffected (rpm)

CPEs: cpe:/a:redhat:openshift_ai:3.5::el9

collectionURL: https://catalog.redhat.com/software/containers/
packageName: rhai/base-image-tpu-rhel9

References

Last enrichment sync: 08-Nov-2026 23:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The librsvg bug, CVE-2026-96889, was made public on September 23 and fixed in sharp on September 27. Red Hat scored it 7.8 and said exploiting it needs user interaction, such as opening a malicious file. Vercel rated Next.js Patches Two Critical RCE Flaws and a Denial-of-Service Bug

People (1)

Vendors (1)

Products (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.