Vulnerability Report

CVE-2026-96889

Title: Use-after-free in librsvg

Memory Corruption

Proof Of Concept

PoC Available for CVE-2026-96889

CWE Category CWE-416

Published Date Sep 23, 2026

Modified Date Sep 25, 2026

Exploit Status Available

Score 7.8 CVSS v3.1

Exploit Probability (EPSS)

0.13%

Vulnerability Summary

CVE-2026-96889: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Impacted Vendors

Analysis in Progress...

Reference Links

https://access.redhat.com/security/cve/CVE-2026-96889 https://bugzilla.redhat.com/show_bug.cgi?id=2539279 https://crates.io/crates/librsvg https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241 https://rustsec.org/advisories/RUSTSEC-2026-0305.html

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-96889 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/rafabd1/VectorFreed

View Code

September 25, 2026 MODIFIED

Vulnerability data updated via NVD.

September 24, 2026 MODIFIED

Vulnerability data updated via NVD.

September 23, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector LOCAL

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.