CVE-2026-96889

Name of the Vulnerable Software and Affected Versions librsvg (affected versions not specified)

Description A use-after-free error occurs when processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations. This happens because the library uses libxml2 to parse XML and incorrectly frees an XML entity that the parser is still using. Specifically, when a recursive XInclude parses a document that declares an entity with a name identical to an existing one, the entity insert() function replaces the first entry, triggering xmlFreeNode() via its Drop implementation. Consequently, the outer xmlCtxtParseEntity() function continues to use the freed xmlEntity memory. This flaw could lead to a denial of service or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.