{"id":"EUVD-2026-85608","enisaUuid":"3896b11d-617f-3457-8976-02ac209cd4e8","description":"A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.","datePublished":"Sep 23, 2026, 7:40:14 PM","dateUpdated":"Oct 21, 2026, 4:48:41 PM","baseScore":7.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://access.redhat.com/errata/RHSA-2026:86331\nhttps://access.redhat.com/errata/RHSA-2026:86841\nhttps://access.redhat.com/errata/RHSA-2026:86842\nhttps://access.redhat.com/errata/RHSA-2026:86921\nhttps://access.redhat.com/security/cve/CVE-2026-96889\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2539279\nhttps://crates.io/crates/librsvg\nhttps://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241\nhttps://rustsec.org/advisories/RUSTSEC-2026-0305.html\n","aliases":"CVE-2026-96889\nGHSA-cpvr-w4j5-2mpg\n","assigner":"redhat","epss":0.53,"enisaIdProduct":[{"id":"1933fa59-e537-3aae-af89-a360e8a74e7f","product":{"name":"Red Hat Enterprise Linux 10","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:1.0.1-1.el10_2.2"},{"id":"838af168-7573-3e8c-b868-1077079777a0","product":{"name":"Red Hat Enterprise Linux 10","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:2.57.1-9.el10_2.10"},{"id":"d5dd5024-619d-3261-bac9-53abed72c1c2","product":{"name":"Red Hat Enterprise Linux 8","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:2.42.7-6.el8_10"},{"id":"fd39d81b-88b4-309d-add9-340af60a0abb","product":{"name":"Red Hat Enterprise Linux 9","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:2.50.7-3.el9_8.1"}],"enisaIdVendor":[{"id":"7ceae257-5eff-372f-a0c4-fd92d17c0ece","vendor":{"name":"Red Hat"}}],"enisaIdVulnerability":[{"id":"0ae4059c-c5d3-3ddc-a1b7-a88e85dbd73f","vulnerability":{"id":"GHSA-cpvr-w4j5-2mpg","description":"Librsvg: Use-after-free when XML includes have duplicated entities","datePublished":"Oct 22, 2026, 3:52:48 PM","dateUpdated":"Oct 22, 2026, 3:52:48 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-96889\nhttps://github.com/GNOME/librsvg/commit/0bc935e675947e185d42005d3ad93d7cf61bcea9\nhttps://github.com/GNOME/librsvg/commit/1606574427408baca8203ef723281509a229f9e2\nhttps://github.com/GNOME/librsvg/commit/4d0051a9dbd038a5fe8461b61486677d88f8736d\nhttps://github.com/GNOME/librsvg/commit/e56cc8a33a7184eef6e8a720414aee6205a400ad\nhttps://rustsec.org/advisories/RUSTSEC-2026-0305.html\nhttps://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241\nhttps://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1211\nhttps://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504\nhttps://gitlab.gnome.org/GNOME/librsvg\nhttps://github.com/GNOME/librsvg/releases/tag/2.63.2\nhttps://github.com/GNOME/librsvg/releases/tag/2.62.4\nhttps://github.com/GNOME/librsvg/releases/tag/2.61.5\nhttps://github.com/GNOME/librsvg/releases/tag/2.60.3\nhttps://github.com/GNOME/librsvg/releases/tag/2.57.5\nhttps://github.com/GNOME/librsvg/blob/2.63.2/NEWS\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2539279\nhttps://access.redhat.com/security/cve/CVE-2026-96889\nhttps://access.redhat.com/errata/RHSA-2026:86921\nhttps://access.redhat.com/errata/RHSA-2026:86842\nhttps://access.redhat.com/errata/RHSA-2026:86841\nhttps://access.redhat.com/errata/RHSA-2026:86331\n","enisa_id":"EUVD-2026-85608\n","aliases":"GHSA-cpvr-w4j5-2mpg\nCVE-2026-96889\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 7:03:20 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"44426ceb-03f0-3d2e-bbeb-3b163c461d63","vulnerability":{"id":"CVE-2026-96889","description":"A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.","datePublished":"Sep 23, 2026, 7:40:14 PM","dateUpdated":"Oct 21, 2026, 4:48:41 PM","status":"PUBLISHED","baseScore":7.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://access.redhat.com/errata/RHSA-2026:86331\nhttps://access.redhat.com/errata/RHSA-2026:86841\nhttps://access.redhat.com/errata/RHSA-2026:86842\nhttps://access.redhat.com/errata/RHSA-2026:86921\nhttps://access.redhat.com/security/cve/CVE-2026-96889\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2539279\nhttps://crates.io/crates/librsvg\nhttps://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241\nhttps://rustsec.org/advisories/RUSTSEC-2026-0305.html\n","enisa_id":"EUVD-2026-85608\n","assigner":"redhat","epss":0.53,"dataProcessed":"Oct 28, 2026, 7:19:59 AM","vulnerabilityProduct":[{"id":"0935b7c1-564f-351b-bcac-83415a34c96d","product":{"name":"Red Hat Enterprise Linux 9","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:2.50.7-3.el9_8.1"},{"id":"1049e355-6ced-3306-9bf6-261f0e34878d","product":{"name":"Red Hat Enterprise Linux 8","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:2.42.7-6.el8_10"},{"id":"6354b6e1-98af-32c3-b99a-89ad3026239f","product":{"name":"Red Hat Enterprise Linux 10","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:1.0.1-1.el10_2.2"},{"id":"e6cc985b-ceed-32e5-b802-5c329bbf5448","product":{"name":"Red Hat Enterprise Linux 10","vendor":{"name":"Red Hat"}},"product_version":"patch: 0:2.57.1-9.el10_2.10"}],"vulnerabilityVendor":[{"id":"1b561867-3924-3fcf-9138-625c09feb5e0","vendor":{"name":"Red Hat"}}]}}],"enisaIdAdvisory":[{"id":"142317d4-7958-3ea7-b7bf-fa339955ce35","advisory":{"id":"SUSE-SU-2026:24117-1","description":"Security update for librsvg","summary":"Security update for librsvg","datePublished":"Oct 8, 2026, 6:13:45 AM","dateUpdated":"Oct 15, 2026, 5:14:06 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24117-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624117-1/\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624117-1/\nhttps://bugzilla.suse.com/1282612\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"6097a6d1-fe46-3166-801d-e82d8590559b","product":{"name":"SUSE Linux Micro 6.2","vendor":{"name":"SUSE"}}},{"id":"675bf0ae-4789-3a38-9c48-bcf36ac0e221","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"84713135-b2cb-3c9a-b8ab-81d07e9a67c3","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"97e0b5a9-6da1-3c0e-9db3-8e058f5f24e5","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a0f9eeef-8cd6-34b2-bb81-c9d24dc47608","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c6c799b2-c965-3d87-b131-77744a208d8f","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"db262e80-991a-3bf4-b516-cd3462ea4414","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"dd5466ec-eccb-321b-81af-22e0bf538992","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ec0eacf9-c6b2-338d-85aa-e43927231a7e","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"46aad7c6-8968-3756-bdca-29079ff7949e","advisory":{"id":"SUSE-SU-2026:24202-1","description":"Security update for librsvg","summary":"Security update for librsvg","datePublished":"Oct 8, 2026, 6:13:45 AM","dateUpdated":"Oct 21, 2026, 11:49:44 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24202-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624202-1/\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624202-1/\nhttps://bugzilla.suse.com/1282612\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"0bcb0ddc-3dc8-3695-b8b2-5526224786d3","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1a418603-31a2-362e-a547-c99329ce5316","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"1cceabda-63c7-3754-a5e2-c5ca737e2d2c","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"26c08a6e-98c4-347d-b9f6-e479be0b2794","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2e542b6c-6c50-36b3-a2cf-e44e12d0b195","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"36eaf24b-4059-3c52-8043-db6c3db59029","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3b5ef8d9-6fe1-327f-9d53-2e1816fd3ed9","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"51190ba1-e523-3d82-ad85-821e33e439dd","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"660df848-8c06-3120-a00c-a3112de2f884","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7f79520a-ad91-3271-a0bc-620855ad8348","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}},{"id":"8564fdf3-a8a7-31a8-9c66-cc038516c341","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"98b4447d-81a0-3c78-8fe0-6776b40c222b","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9c7a06a9-98fb-3690-bc14-16c32868a757","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9f13a679-aba4-34d2-b316-29f28a2a1f27","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a8d1d9de-4b83-3750-8532-a9160b3a466a","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"aeedb044-1e94-3d1f-80f5-4d7c728ee1b7","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c0453652-ec68-312c-ae08-34ffffad6e2c","product":{"name":"rsvg-thumbnailer-0:2.60.3-160000.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"c555d8a4-e4cb-397a-9307-437a62fbb1da","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"c85d6684-971d-3f0b-bc5c-5d181fd99d66","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d6ccd6c6-17fb-35aa-a8f4-ec4ea71cc6ac","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"dc49637d-d5ee-37d0-94ef-73c75ec7afeb","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"ec5e4e60-30f7-316d-b67c-dea269632e5f","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f0ea0d77-3007-3e95-9689-a53a0645935c","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"5bdb925f-76f3-3502-9c58-f1de56ebec7b","advisory":{"id":"RHSA-2026:86841","description":"security update for librsvg2","summary":"security update for librsvg2","datePublished":"Oct 21, 2026, 12:00:00 AM","dateUpdated":"Oct 23, 2026, 9:39:38 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_86841.json\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008319.html\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008319.html\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"89307bfb-1f84-32ea-95f9-998c5a157a5b","product":{"name":"librsvg2-tools-0:2.57.1-9.el10_2.10.x86_64","vendor":{"name":"Red Hat"}}},{"id":"9938cf1f-b799-3cd8-9637-61f63eb65992","product":{"name":"SUSE Liberty Linux 10","vendor":{"name":"SUSE"}}},{"id":"9fa4cf23-0b66-35f5-9765-ee7782b015b1","product":{"name":"librsvg2-0:2.57.1-9.el10_2.10.x86_64","vendor":{"name":"Red Hat"}}},{"id":"9fecb922-264c-37d4-bd15-d4c4b7d10977","product":{"name":"rsvg-pixbuf-loader-0:2.57.1-9.el10_2.10.x86_64","vendor":{"name":"Red Hat"}}},{"id":"ac0af1b2-85a0-37c4-81db-385f7ed38efd","product":{"name":"librsvg2-devel-0:2.57.1-9.el10_2.10.x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"76b9e94d-cc13-3aed-aa2b-4b8e76e796fa","advisory":{"id":"RHSA-2026:86921","description":"security update for librsvg2","summary":"security update for librsvg2","datePublished":"Oct 21, 2026, 12:00:00 AM","dateUpdated":"Oct 23, 2026, 9:39:39 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_86921.json\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008333.html\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008333.html\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"3c391349-e512-3d19-a355-6caaa86b6a8d","product":{"name":"librsvg2-0:2.50.7-3.el9_8.1.x86_64","vendor":{"name":"Red Hat"}}},{"id":"71b2f54a-3275-3637-af69-b77ff1e5edac","product":{"name":"librsvg2-tools-0:2.50.7-3.el9_8.1.x86_64","vendor":{"name":"Red Hat"}}},{"id":"8fd8bbf3-5178-3204-9e60-c4151480d7bf","product":{"name":"librsvg2-0:2.50.7-3.el9_8.1.i686","vendor":{"name":"Red Hat"}}},{"id":"ae1593fc-f63e-3909-98f6-f80598e877b3","product":{"name":"librsvg2-devel-0:2.50.7-3.el9_8.1.i686","vendor":{"name":"Red Hat"}}},{"id":"dca9ad06-3247-3e97-aa18-3330f829f25d","product":{"name":"SUSE Liberty Linux 9","vendor":{"name":"SUSE"}}},{"id":"f5d8b05b-8f28-3f99-8f00-5c7eb8cbfb7a","product":{"name":"librsvg2-devel-0:2.50.7-3.el9_8.1.x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"818d0cfb-9b21-35e8-8a69-c035d621c351","advisory":{"id":"openSUSE-SU-2026:22051-1","description":"Security update for librsvg","summary":"Security update for librsvg","datePublished":"Oct 8, 2026, 6:15:26 AM","dateUpdated":"Oct 19, 2026, 5:24:39 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_22051-1.json\nhttps://bugzilla.suse.com/1282612\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1400cf3f-1b40-33ce-8c8d-571932c35255","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"1f629fa4-3263-3009-8acf-aebf6313ce5e","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2267cd46-3562-30a7-a672-30c1119f61a6","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"22978eea-2e61-37ab-bcfa-3bb49a18f6da","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"25c231bd-402e-373b-bb36-8ce3cee28d8c","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"300b061e-99f3-3603-a85e-d3f2e88a87b7","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"31c31b4c-89d4-3253-976e-b6db73fb4bbe","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"3abac298-df24-3eba-ad42-7c487e0e9b67","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"418da577-0c85-3da1-8ef9-c3bce76c98df","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4ce039be-fa27-3cfb-9efc-cde3780c3582","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"598d8896-b49a-3168-886f-75f8d08b914f","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5e776b86-1be3-3a9e-92fc-1fbbc4b92a6f","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"604411ee-9c78-3b97-9082-e939cd7d53e4","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"699c8a9a-9e22-3b2d-83aa-4b923f497983","product":{"name":"typelib-1_0-Rsvg-2_0-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6b3c8260-05ed-398a-b436-1c438808b2f0","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"73fb3425-3d61-383d-99ef-0159dbe6f2e7","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"80187fb0-f1f2-3ccd-9ed3-9ee72aa1268e","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"875e350a-d061-3e65-9ce6-90a0d52187af","product":{"name":"rsvg-convert-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e3f0e3fc-99e8-3bc9-848f-28ba625c01a3","product":{"name":"gdk-pixbuf-loader-rsvg-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e6ee3ffa-7db0-3366-aaa0-cf635a4ed72f","product":{"name":"rsvg-thumbnailer-0:2.60.3-160000.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"ec7637c5-4f1f-36c3-881c-c1ec17a24368","product":{"name":"librsvg-devel-0:2.60.3-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"fb7943d6-2764-332c-abc0-031959dd49c0","product":{"name":"librsvg-2-2-0:2.60.3-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"ac94a439-4b95-3f26-94a6-9c2196c891ff","advisory":{"id":"msrc_CVE-2026-96889","description":"Librsvg: use-after-free when xml includes have duplicated entities","datePublished":"Sep 27, 2026, 11:30:17 PM","dateUpdated":"Oct 7, 2026, 2:00:08 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-96889.json\n","aliases":"CVE-2026-96889\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"23f235ef-98d7-3592-b620-8b6911a7d30a","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"65e2275c-b881-3a69-afde-ab6f5a525d15","product":{"name":"azl3 librsvg2 0:2.58.1-8.azl3","vendor":{"name":"Microsoft"}}},{"id":"97bc5b7a-b62e-317a-ac2e-3c08da8ffa79","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"e40b5b9a-7565-3fab-86aa-5ac8ab8935ea","product":{"name":"librsvg2","vendor":{"name":"Microsoft"}}}]}},{"id":"b2b74ee9-f316-3ebf-9fa9-ab0804d279be","advisory":{"id":"RHSA-2026:86842","description":"security update for librsvg2","summary":"security update for librsvg2","datePublished":"Oct 21, 2026, 12:00:00 AM","dateUpdated":"Oct 23, 2026, 9:39:38 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_86842.json\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008320.html\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008320.html\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"075c1819-c183-3b05-8970-71128c36e044","product":{"name":"librsvg2-tools-0:2.42.7-6.el8_10.x86_64","vendor":{"name":"Red Hat"}}},{"id":"49ff01b9-264a-3173-8799-c353f6da2bdb","product":{"name":"librsvg2-devel-0:2.42.7-6.el8_10.i686","vendor":{"name":"Red Hat"}}},{"id":"744890a2-54f6-3f78-961f-992650f723c3","product":{"name":"librsvg2-0:2.42.7-6.el8_10.x86_64","vendor":{"name":"Red Hat"}}},{"id":"9682bd6b-6a00-3f70-a754-2eb437b0084f","product":{"name":"librsvg2-devel-0:2.42.7-6.el8_10.x86_64","vendor":{"name":"Red Hat"}}},{"id":"988ee49f-abd1-3c3b-975f-7a61eae01e57","product":{"name":"SUSE Liberty Linux 8","vendor":{"name":"SUSE"}}},{"id":"d474fc5d-3d35-3871-b7ba-23112bebb6a2","product":{"name":"librsvg2-0:2.42.7-6.el8_10.i686","vendor":{"name":"Red Hat"}}}]}},{"id":"f23909db-7756-37a9-9de2-fae558d6e030","advisory":{"id":"RHSA-2026:86331","description":"security update for glycin-loaders","summary":"security update for glycin-loaders","datePublished":"Oct 20, 2026, 12:00:00 AM","dateUpdated":"Oct 21, 2026, 7:01:59 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_86331.json\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008281.html\nhttps://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-October/008281.html\nhttps://www.suse.com/security/cve/CVE-2026-96889/\n","aliases":"CVE-2026-96889\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"3e6386f7-107e-3c96-ad70-9e7cb1e98606","product":{"name":"glycin-loaders-0:1.0.1-1.el10_2.2.x86_64","vendor":{"name":"Red Hat"}}},{"id":"dd131feb-b04b-3fcc-aaea-e6e2d5475c0f","product":{"name":"SUSE Liberty Linux 10","vendor":{"name":"SUSE"}}}]}}]}