Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 275/275 feeds/APIs · 469/469 docs · 9/9 advisories · checked 06:21 UTC Customize Public modeDiscuss ChangeIntel on Discord

Librsvg: use-after-free when xml includes have duplicated entities

Assessment

Severity
Important
CVSS base score
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Impact
Not stated
EPSS · 30-day forecast
No EPSS score collected
Public detection template
No Nuclei template is listed in the current collected catalog
Exploitation detected
Unknown: not stated by MSRC
Exploitability
Not assessed
Publicly disclosed
Unknown: not stated by MSRC
Customer action
Required: follow the MSRC remediation guidance
Component
Mariner
Weakness
CWE-416: Use After Free
Issued by
redhat
Published
27 Sep 2026 · September 2026
Last revised
7 Oct 2026Information published.
CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
LocalAV:L
Attack complexity
LowAC:L
Privileges required
NonePR:N
User interaction
RequiredUI:R
Scope
UnchangedS:U
Confidentiality
HighC:H
Integrity
HighI:H
Availability
HighA:H

Updates that fix it

0 KBs

No KB listed

No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.

Affected products

Open Source Software
1 affected product
  • azl3 librsvg2 2.58.1-8 on Azure Linux 3.0

What changed

  1. Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
  2. Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
  3. Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
  4. Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
  5. Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → Unknown: not stated by MSRC · Exploitation detected: Not reported by MSRC → Unknown: not stated by MSRC
  6. Affected products: azl3 libical 3.0.10-1 on Azure Linux 3.0 → azl3 librsvg2 2.58.1-8 on Azure Linux 3.0
  7. Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed · CISA KEV: Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
  8. Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained · CISA KEV: Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version
Field-level log (36)

Up to 100 recent field edits are shown; older edits may be outside retention.

  1. 6 Nov 2026 · 17:32:22 UTC Public detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
  2. 6 Nov 2026 · 17:32:22 UTC Source coverage: public-exploit-codeIncomplete → Current
  3. 6 Nov 2026 · 17:32:22 UTC Source coverage: first-epssIncomplete → Current
  4. 6 Nov 2026 · 17:32:22 UTC Source coverage: msrc-cvrfIncomplete → Current
  5. 6 Nov 2026 · 16:31:02 UTC Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
  6. 6 Nov 2026 · 16:31:02 UTC Source coverage: public-exploit-codeCurrent → Incomplete
  7. 6 Nov 2026 · 16:31:02 UTC Source coverage: first-epssCurrent → Incomplete
  8. 6 Nov 2026 · 16:31:02 UTC Source coverage: msrc-cvrfCurrent → Incomplete
  9. 2 Nov 2026 · 17:30:39 UTC Public detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
  10. 2 Nov 2026 · 17:30:39 UTC Source coverage: public-exploit-codeIncomplete → Current
  11. 2 Nov 2026 · 17:30:39 UTC Source coverage: first-epssIncomplete → Current
  12. 2 Nov 2026 · 17:30:39 UTC Source coverage: msrc-cvrfIncomplete → Current
  13. 2 Nov 2026 · 16:27:39 UTC Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
  14. 2 Nov 2026 · 16:27:39 UTC Source coverage: public-exploit-codeCurrent → Incomplete
  15. 2 Nov 2026 · 16:27:39 UTC Source coverage: first-epssCurrent → Incomplete
  16. 2 Nov 2026 · 16:27:39 UTC Source coverage: msrc-cvrfCurrent → Incomplete
  17. 29 Oct 2026 · 20:19:26 UTC Public detection templateNo Nuclei template listed
  18. 29 Oct 2026 · 20:19:26 UTC EPSSNot scored → No EPSS score collected
  19. 29 Oct 2026 · 20:19:26 UTC Customer actionRequired: apply the update → Required: follow the MSRC remediation guidance
  20. 29 Oct 2026 · 20:19:26 UTC Publicly disclosedNo → Unknown: not stated by MSRC
  21. 29 Oct 2026 · 20:19:26 UTC Exploitation detectedNot reported by MSRC → Unknown: not stated by MSRC
  22. 29 Oct 2026 · 11:17:40 UTC Affected productsazl3 libical 3.0.10-1 on Azure Linux 3.0 → azl3 librsvg2 2.58.1-8 on Azure Linux 3.0
  23. 23 Oct 2026 · 09:33:49 UTC Public exploit codeUnknown: exploit-code evidence is incomplete or retained → No Nuclei template listed
  24. 23 Oct 2026 · 09:33:49 UTC CISA KEVUnknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
  25. 23 Oct 2026 · 09:33:49 UTC Source coverage: public-exploit-codeIncomplete → Current
  26. 23 Oct 2026 · 09:33:49 UTC Source coverage: first-epssIncomplete → Current
  27. 23 Oct 2026 · 09:33:49 UTC Source coverage: cisa-kevIncomplete → Current
  28. 23 Oct 2026 · 09:33:49 UTC Source coverage: msrc-cvrfIncomplete → Current
  29. 23 Oct 2026 · 08:31:50 UTC Public exploit codeNo Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained
  30. 23 Oct 2026 · 08:31:50 UTC CISA KEVNot listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
  31. 23 Oct 2026 · 08:31:50 UTC Source coverage: public-exploit-codeCurrent → Incomplete
  32. 23 Oct 2026 · 08:31:50 UTC Source coverage: first-epssCurrent → Incomplete
  33. 23 Oct 2026 · 08:31:50 UTC Source coverage: cisa-kevCurrent → Incomplete
  34. 23 Oct 2026 · 08:31:50 UTC Source coverage: msrc-cvrfCurrent → Incomplete
  35. 18 Oct 2026 · 14:54:30 UTC Link: September 2026/security?release=2026-Sep#cves
  36. 14 Oct 2026 · 11:22:42 UTC Source coverage: msrc-cvrfIncomplete → Current

Explore global source statements, affected packages and advisory history for CVE-2026-96889. The catalog has a separate collection scope from Microsoft release records.

cve-program · CVE-2026-96889

Published

glycin-loaders

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "glycin-loaders",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:1.0.1-1.el10_2.2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10.2"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.57.1-9.el10_2.10",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10.2"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.57.1-9.el10_0.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux_eus:10.0"
                    ]
                }

glycin-loaders

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "glycin-loaders",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:1.0.1-1.el10_0.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux_eus:10.0"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.40.20-1.el7_9.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:7"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-6.el8_10",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-4.el8_4.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_aus:8.4::appstream",
                        "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-4.el8_4.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_aus:8.4::appstream",
                        "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-4.el8_6.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_aus:8.6::appstream",
                        "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-4.el8_6.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_aus:8.6::appstream",
                        "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-4.el8_8.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_e4s:8.8::appstream",
                        "cpe:/a:redhat:rhel_tus:8.8::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.42.7-4.el8_8.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_e4s:8.8::appstream",
                        "cpe:/a:redhat:rhel_tus:8.8::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.50.7-3.el9_8.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.50.7-1.el9_2.2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_e4s:9.2::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.50.7-3.el9_4.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_e4s:9.4::appstream"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:2.50.7-3.el9_6.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_eus:9.6::appstream"
                    ]
                }

rhai/base-image-tpu-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.0",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-tpu-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329706",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.0::el9"
                    ]
                }

rhai/base-image-cpu-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.0",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cpu-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329709",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.0::el9"
                    ]
                }

rhai/base-image-spyre-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.0",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-spyre-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793327611",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.0::el9"
                    ]
                }

rhai/base-image-rocm-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.0",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-rocm-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329305",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.0::el9"
                    ]
                }

rhai/base-image-cuda-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.0",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cuda-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793328358",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.0::el9"
                    ]
                }

rhai/base-image-tpu-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-tpu-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793330461",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-cpu-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cpu-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793327311",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-neuron-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-neuron-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329624",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-spyre-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-spyre-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793326217",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-gaudi-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-gaudi-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793327499",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-rocm-6.4-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-rocm-6.4-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329011",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-cuda-13.0-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cuda-13.0-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793326837",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-cuda-12.9-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cuda-12.9-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793326796",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-rocm-7.1-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.4",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-rocm-7.1-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793330096",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.4::el9"
                    ]
                }

rhai/base-image-neuron-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-neuron-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793326392",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-tpu-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-tpu-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793328643",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-gaudi-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-gaudi-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793327512",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-cpu-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cpu-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793330940",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-rubin-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-rubin-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329296",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-cuda-13.0-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cuda-13.0-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793329271",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-rocm-7.14-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-rocm-7.14-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793326530",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-spyre-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-spyre-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793330882",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

rhai/base-image-cuda-12.9-rhel9

https://catalog.redhat.com/software/containers/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI 3.5",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhai/base-image-cuda-12.9-rhel9",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "1793327660",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai:3.5::el9"
                    ]
                }

librsvg2

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "librsvg2",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/o:redhat:rhel_els:6"
                    ]
                }

rhelai3/bootc-cuda-rhel9

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhelai3/bootc-cuda-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux_ai:3"
                    ]
                }

rhelai3/bootc-gaudi-rhel9

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhelai3/bootc-gaudi-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux_ai:3"
                    ]
                }

rhelai3/bootc-rocm-rhel9

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhelai3/bootc-rocm-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux_ai:3"
                    ]
                }

rhelai3/disk-image-cuda-rhel9

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhelai3/disk-image-cuda-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux_ai:3"
                    ]
                }

rhoai/odh-feature-server-rhel9

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range
{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift AI (RHOAI)",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhoai/odh-feature-server-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_ai"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-85608

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 23, 2026, 7:40:14 PM

dateUpdated: Nov 5, 2026, 12:15:12 AM

41 related source bulletins · separate from aliases

RHSA-2026:92212: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

SUSE-SU-2026:24117-1: Security update for librsvg

CVE-2026-96889

RHSA-2026:92573: Red Hat Security Advisory: glycin-loaders security update

CVE-2026-96889

RHSA-2026:94454: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (TPU)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94461: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (Spyre)

CVE-2026-44172 · CVE-2026-96889 · CVE-2026-111497

RHSA-2026:92579: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94469: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CUDA 12.9)

CVE-2026-44172 · CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94473: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (Spyre)

CVE-2026-96889 · CVE-2026-111497

openSUSE-SU-2026:12364-1: librsvg-2-2-2.63.4-1.1 on GA media

CVE-2026-96889

SUSE-SU-2026:24202-1: Security update for librsvg

CVE-2026-96889

RHSA-2026:94472: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (ROCm 7.1)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:92382: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:86841: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94468: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CUDA 13.0)

CVE-2025-69418 · CVE-2026-6653 · CVE-2026-11979 · CVE-2026-13346 · CVE-2026-28390 · CVE-2026-31790 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-44172 · CVE-2026-45445 · CVE-2026-45447 · CVE-2026-74860 · CVE-2026-86138 · CVE-2026-86140 · CVE-2026-86142 · CVE-2026-86143 · CVE-2026-86144 · CVE-2026-86145 · CVE-2026-89161 · CVE-2026-96889 · CVE-2026-103111 · CVE-2026-111497 · CVE-2026-114406

RHSA-2026:94459: Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CPU)

CVE-2025-8869 · CVE-2025-13327 · CVE-2025-69418 · CVE-2026-1703 · CVE-2026-6653 · CVE-2026-11979 · CVE-2026-13346 · CVE-2026-28390 · CVE-2026-31790 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-45445 · CVE-2026-45447 · CVE-2026-74860 · CVE-2026-86138 · CVE-2026-86140 · CVE-2026-86142 · CVE-2026-86143 · CVE-2026-86144 · CVE-2026-86145 · CVE-2026-89161 · CVE-2026-96889 · CVE-2026-103111 · CVE-2026-111497 · CVE-2026-114406

RHSA-2026:86921: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94476: Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CUDA)

CVE-2025-8869 · CVE-2025-13327 · CVE-2025-69418 · CVE-2026-1703 · CVE-2026-3219 · CVE-2026-6357 · CVE-2026-6653 · CVE-2026-11979 · CVE-2026-13346 · CVE-2026-28390 · CVE-2026-31790 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-45445 · CVE-2026-45447 · CVE-2026-74860 · CVE-2026-86138 · CVE-2026-86140 · CVE-2026-86142 · CVE-2026-86143 · CVE-2026-86144 · CVE-2026-86145 · CVE-2026-89161 · CVE-2026-96889 · CVE-2026-103111 · CVE-2026-111497 · CVE-2026-114109 · CVE-2026-114110 · CVE-2026-114406

RHSA-2026:92353: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

openSUSE-SU-2026:22051-1: Security update for librsvg

CVE-2026-96889

RHSA-2026:92214: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94453: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (Neuron)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94460: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (Gaudi)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94474: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 12.9)

CVE-2025-69418 · CVE-2026-6653 · CVE-2026-11979 · CVE-2026-13346 · CVE-2026-28390 · CVE-2026-31790 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-45445 · CVE-2026-45447 · CVE-2026-74860 · CVE-2026-86138 · CVE-2026-86140 · CVE-2026-86142 · CVE-2026-86143 · CVE-2026-86144 · CVE-2026-86145 · CVE-2026-89161 · CVE-2026-96889 · CVE-2026-103111 · CVE-2026-111497 · CVE-2026-114406

RHSA-2026:94458: Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (TPU)

CVE-2026-96889 · CVE-2026-111497

msrc_CVE-2026-96889: Librsvg: use-after-free when xml includes have duplicated entities

CVE-2026-96889

RHSA-2026:86842: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:92336: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94464: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (Gaudi)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94462: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CPU)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94470: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 13.0)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94471: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (ROCm 7.14)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:92218: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94452: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (TPU)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94463: Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (Spyre)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94467: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (Rubin)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:92213: Red Hat Security Advisory: librsvg2 security update

CVE-2026-96889

RHSA-2026:94465: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (ROCm 6.4)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:86331: Red Hat Security Advisory: glycin-loaders security update

CVE-2026-96889

RHSA-2026:94457: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (Neuron)

CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94455: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CPU)

CVE-2026-44172 · CVE-2026-96889 · CVE-2026-111497

RHSA-2026:94466: Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (ROCm)

CVE-2026-96889 · CVE-2026-111497

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-96889

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-416

Original publisher date fields

published: 2026-09-23T20:17:27.587

lastModified: 2026-11-05T01:17:25.013

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-cpvr-w4j5-2mpg

Published

librsvg

crates.io

SEMVER · introduced 0 → fixed 2.57.5

librsvg

crates.io

SEMVER · introduced 2.60.0-beta.0 → fixed 2.60.3

librsvg

crates.io

SEMVER · introduced 2.61.0 → fixed 2.61.5

librsvg

crates.io

SEMVER · introduced 2.62.0-beta.0 → fixed 2.62.4

librsvg

crates.io

SEMVER · introduced 2.63.0-beta.0 → fixed 2.63.2

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2026-0305

Published

librsvg

crates.io

SEMVER · introduced 0.0.0-0 → fixed 2.57.5 → introduced 2.57.90 → fixed 2.60.3 → introduced 2.61.0 → fixed 2.61.5 → introduced 2.61.90 → fixed 2.62.4 → introduced 2.62.90 → fixed 2.63.2

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 8 Nov 06:21 UTC · 275 of 275 readable · 273 fully read · documentation 469/469 current