Read the docs
TI-2026-63916 Aliases CVE-2026-96889GHSA-cpvr-w4j5-2mpg

Librsvg: use-after-free when xml includes have duplicated entities

Priority HIGH 69CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 17 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00564 47th percentileScored 2026-11-08
Fix Partial librsvg (crates.io): 2.57.5, 2.60.3, 2.61.5 +2Red Hat: 36 advisoriesRed Hat: 17 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—1.0.1-1.el10_2.2Patch availableCNA
Red HatRed Hat Enterprise Linux 10—2.57.1-9.el10_2.10Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—2.57.1-9.el10_0.1Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—1.0.1-1.el10_0.1Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—2.40.20-1.el7_9.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.42.7-6.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—2.42.7-4.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—2.42.7-4.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—2.42.7-4.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—2.42.7-4.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—2.42.7-4.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—2.42.7-4.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.50.7-3.el9_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—2.50.7-1.el9_2.2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—2.50.7-3.el9_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—2.50.7-3.el9_6.1Patch availableCNA
Red HatRed Hat OpenShift AI 3.0—1793329706Patch availableCNA
Red HatRed Hat OpenShift AI 3.0—1793329709Patch availableCNA
Red HatRed Hat OpenShift AI 3.0—1793327611Patch availableCNA
Red HatRed Hat OpenShift AI 3.0—1793329305Patch availableCNA
Red HatRed Hat OpenShift AI 3.0—1793328358Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793330461Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793327311Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793329624Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793326217Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793327499Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793329011Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793326837Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793326796Patch availableCNA
Red HatRed Hat OpenShift AI 3.4—1793330096Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793326392Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793328643Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793327512Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793330940Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793329296Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793329271Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793326530Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793330882Patch availableCNA
Red HatRed Hat OpenShift AI 3.5—1793327660Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3——No fix listedCNA
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3——No fix listedCNA
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3——No fix listedCNA
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3——No fix listedCNA
Red HatRed Hat OpenShift AI (RHOAI)——No fix listedCNA
—librsvg (crates.io)before 2.57.52.57.5Patch availableGHSA-cpvr-w4j5-2mpg
—librsvg (crates.io)2.60.0-beta.0 to before 2.60.32.60.3Patch availableGHSA-cpvr-w4j5-2mpg
—librsvg (crates.io)2.61.0 to before 2.61.52.61.5Patch availableGHSA-cpvr-w4j5-2mpg
—librsvg (crates.io)2.62.0-beta.0 to before 2.62.42.62.4Patch availableGHSA-cpvr-w4j5-2mpg
—librsvg (crates.io)2.63.0-beta.0 to before 2.63.22.63.2Patch availableGHSA-cpvr-w4j5-2mpg
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.0.1-1.el10_2.2 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 2.57.1-9.el10_2.10 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 2.57.1-9.el10_0.1 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.0.1-1.el10_0.1 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 2.40.20-1.el7_9.1 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.42.7-6.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.42.7-4.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 2.42.7-4.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.42.7-4.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 2.42.7-4.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.42.7-4.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.42.7-4.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.50.7-3.el9_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.50.7-1.el9_2.2 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.50.7-3.el9_4.1 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.50.7-3.el9_6.1 Patch available CNA
  • Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1793329706 Patch available CNA
  • Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1793329709 Patch available CNA
  • Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1793327611 Patch available CNA
  • Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1793329305 Patch available CNA
  • Red Hat OpenShift AI 3.0 VendorRed Hat Affected — Fixed in 1793328358 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793330461 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793327311 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793329624 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793326217 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793327499 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793329011 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793326837 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793326796 Patch available CNA
  • Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1793330096 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793326392 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793328643 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793327512 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793330940 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793329296 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793329271 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793326530 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793330882 Patch available CNA
  • Red Hat OpenShift AI 3.5 VendorRed Hat Affected — Fixed in 1793327660 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux AI (RHEL AI) 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux AI (RHEL AI) 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux AI (RHEL AI) 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux AI (RHEL AI) 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — No fix listed CNA
  • librsvg (crates.io) Vendor— Affected before 2.57.5 Fixed in 2.57.5 Patch available GHSA-cpvr-w4j5-2mpg
  • librsvg (crates.io) Vendor— Affected 2.60.0-beta.0 to before 2.60.3 Fixed in 2.60.3 Patch available GHSA-cpvr-w4j5-2mpg
  • librsvg (crates.io) Vendor— Affected 2.61.0 to before 2.61.5 Fixed in 2.61.5 Patch available GHSA-cpvr-w4j5-2mpg
  • librsvg (crates.io) Vendor— Affected 2.62.0-beta.0 to before 2.62.4 Fixed in 2.62.4 Patch available GHSA-cpvr-w4j5-2mpg
  • librsvg (crates.io) Vendor— Affected 2.63.0-beta.0 to before 2.63.2 Fixed in 2.63.2 Patch available GHSA-cpvr-w4j5-2mpg

CPE names CNA · 20

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:rhel_aus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_aus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.8::appstream8.8—Red Hat
cpe:/a:redhat:rhel_tus:8.8::appstream8.8—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
Show 10 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_e4s:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/a:redhat:openshift_ai:3.0::el93.0—Red Hat
cpe:/a:redhat:openshift_ai:3.4::el93.4—Red Hat
cpe:/a:redhat:openshift_ai:3.5::el93.5—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
cpe:/a:redhat:enterprise_linux_ai:33—Red Hat
cpe:/a:redhat:openshift_ai——Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/a:redhat:openshift_ai:3.0::el9 Versions 3.0 — ·Red Hat
  • cpe:/a:redhat:openshift_ai:3.4::el9 Versions 3.4 — ·Red Hat
  • cpe:/a:redhat:openshift_ai:3.5::el9 Versions 3.5 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux_ai:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:openshift_ai Versions — — ·Red Hat

Remediation

  • Fix · GHSA-cpvr-w4j5-2mpg librsvg (crates.io) Fixed in 2.57.5 Advisory →
  • Fix · GHSA-cpvr-w4j5-2mpg librsvg (crates.io) Fixed in 2.60.3 Advisory →
  • Fix · GHSA-cpvr-w4j5-2mpg librsvg (crates.io) Fixed in 2.61.5 Advisory →
  • Fix · GHSA-cpvr-w4j5-2mpg librsvg (crates.io) Fixed in 2.62.4 Advisory →
  • Fix · GHSA-cpvr-w4j5-2mpg librsvg (crates.io) Fixed in 2.63.2 Advisory →

Red Hat 36 advisories

  • RHSA-2026:94476 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.8 (CUDA)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:94474 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.5.6 (CUDA 12.9)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:94473 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
Show 33 more Red Hat advisories
  • RHSA-2026:94472 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:94471 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:94470 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:94469 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:94468 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.7 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:94467 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:94466 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.0.8 (ROCm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:94465 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:94464 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:94463 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.0.8 (Spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:94462 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:94461 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:94460 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:94459 Released 2026-11-03 · Red Hat rating Critical
    Red Hat AI Base Images 3.0.8 (CPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:94458 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.0.8 (TPU)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:94455 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:94454 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:94453 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.5.6 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:94452 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:94457 Released 2026-11-03 · Red Hat rating Important
    Red Hat AI Base Images 3.4.7 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:92579 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) librsvg2-2.40.20-1.el7_9.1, librsvg2-2.40.20-1.el7_9.1.ppc, librsvg2-devel-2.40.20-1.el7_9.1 +2
  • RHSA-2026:92573 Released 2026-10-29 · Red Hat rating Important
    glycin-loaders security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) glycin-loaders-1.0.1-1.el10_0.1
  • RHSA-2026:92382 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) librsvg2-2.42.7-4.el8_8.1, librsvg2-devel-2.42.7-4.el8_8.1, librsvg2-tools-2.42.7-4.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) librsvg2-2.42.7-4.el8_8.1, librsvg2-devel-2.42.7-4.el8_8.1, librsvg2-tools-2.42.7-4.el8_8.1
  • RHSA-2026:92353 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) librsvg2-2.42.7-4.el8_4.1, librsvg2-devel-2.42.7-4.el8_4.1, librsvg2-tools-2.42.7-4.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) librsvg2-2.42.7-4.el8_4.1, librsvg2-devel-2.42.7-4.el8_4.1, librsvg2-tools-2.42.7-4.el8_4.1
  • RHSA-2026:92336 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) librsvg2-2.42.7-4.el8_6.1, librsvg2-devel-2.42.7-4.el8_6.1, librsvg2-tools-2.42.7-4.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) librsvg2-2.42.7-4.el8_6.1, librsvg2-devel-2.42.7-4.el8_6.1, librsvg2-tools-2.42.7-4.el8_6.1
  • RHSA-2026:92218 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) librsvg2-2.50.7-3.el9_4.1, librsvg2-devel-2.50.7-3.el9_4.1, librsvg2-tools-2.50.7-3.el9_4.1
  • RHSA-2026:92212 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) librsvg2-2.50.7-3.el9_6.1, librsvg2-devel-2.50.7-3.el9_6.1, librsvg2-tools-2.50.7-3.el9_6.1
  • RHSA-2026:92213 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) librsvg2-2.50.7-1.el9_2.2, librsvg2-devel-2.50.7-1.el9_2.2, librsvg2-tools-2.50.7-1.el9_2.2
  • RHSA-2026:92214 Released 2026-10-29 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) librsvg2-2.57.1-9.el10_0.1, librsvg2-devel-2.57.1-9.el10_0.1, librsvg2-tools-2.57.1-9.el10_0.1 +1
  • RHSA-2026:86921 Released 2026-10-21 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) librsvg2-2.50.7-3.el9_8.1, librsvg2-devel-2.50.7-3.el9_8.1, librsvg2-tools-2.50.7-3.el9_8.1
  • RHSA-2026:86842 Released 2026-10-21 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) librsvg2-2.42.7-6.el8_10, librsvg2-devel-2.42.7-6.el8_10, librsvg2-tools-2.42.7-6.el8_10
  • RHSA-2026:86841 Released 2026-10-21 · Red Hat rating Important
    librsvg2 security update
    • Red Hat Enterprise Linux AppStream (v. 10) librsvg2-2.57.1-9.el10_2.10, librsvg2-devel-2.57.1-9.el10_2.10, librsvg2-tools-2.57.1-9.el10_2.10 +1
  • RHSA-2026:86331 Released 2026-10-21 · Red Hat rating Important
    glycin-loaders security update
    • Red Hat Enterprise Linux AppStream (v. 10) glycin-loaders-1.0.1-1.el10_2.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86331, RHSA-2026:86841
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86842
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86921
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:92353
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:92336
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:92382
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:92213
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:92218
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:92214, RHSA-2026:92573
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:92212
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:92353
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:92336
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:92382
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:92579
Red Hat OpenShift AI 3.0Fixed RHSA-2026:94458, RHSA-2026:94459, RHSA-2026:94463, RHSA-2026:94466, RHSA-2026:94476
Red Hat OpenShift AI 3.4Fixed RHSA-2026:94452, RHSA-2026:94455, RHSA-2026:94457, RHSA-2026:94461, RHSA-2026:94464, RHSA-2026:94465, RHSA-2026:94468, RHSA-2026:94469, RHSA-2026:94472
Red Hat OpenShift AI 3.5Fixed RHSA-2026:94453, RHSA-2026:94454, RHSA-2026:94460, RHSA-2026:94462, RHSA-2026:94467, RHSA-2026:94470, RHSA-2026:94471, RHSA-2026:94473, RHSA-2026:94474

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-96889
  2. 2026-10-21 Fix available: glycin-loaders@0:1.0.1-1.el10_2.2 · CNA
  3. 2026-10-21 1 new reference · CNA
  4. 2026-10-21 Fix available: RHSA-2026:86331 · Red Hat
  5. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
  6. 2026-10-21 Fix available: librsvg2@0:2.57.1-9.el10_2.10 · CNA
  7. 2026-10-21 1 new reference · CNA
  8. 2026-10-21 Fix available: librsvg2@0:2.42.7-6.el8_10, librsvg2@0:2.50.7-3.el9_8.1 · CNA
  9. 2026-10-21 2 new references · CNA
  10. 2026-10-21 Fix available: RHSA-2026:86841 · Red Hat
  11. 2026-10-21 Fix available: RHSA-2026:86842 · Red Hat
  12. 2026-10-21 Fix available: RHSA-2026:86921 · Red Hat
  13. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
  14. 2026-10-22 Alias added: GHSA-cpvr-w4j5-2mpg
  15. 2026-10-22 Fix available: crates.io/[email protected], crates.io/[email protected], crates.io/[email protected] +2 · GHSA-cpvr-w4j5-2mpg
  16. 2026-10-22 CVSS score added · GHSA-cpvr-w4j5-2mpg
  17. 2026-10-22 Weakness changed · GHSA-cpvr-w4j5-2mpg
  18. 2026-10-22 22 new references · GHSA-cpvr-w4j5-2mpg
  19. 2026-10-29 Fix available: librsvg2@0:2.42.7-4.el8_6.1 · CNA
  20. 2026-10-29 1 new reference · CNA
  21. 2026-10-29 Fix available: librsvg2@0:2.42.7-4.el8_4.1 · CNA
  22. 2026-10-29 1 new reference · CNA
  23. 2026-10-29 Fix available: RHSA-2026:92353 · Red Hat
  24. 2026-10-29 Fix available: RHSA-2026:92336 · Red Hat
  25. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) +1 · Red Hat
  26. 2026-10-29 Fix available: librsvg2@0:2.40.20-1.el7_9.1, librsvg2@0:2.42.7-4.el8_8.1, librsvg2@0:2.50.7-1.el9_2.2 +3 · CNA
  27. 2026-10-29 6 new references · CNA
  28. 2026-10-30 Fix available: RHSA-2026:92212 · Red Hat
  29. 2026-10-30 Fix available: RHSA-2026:92218 · Red Hat
  30. 2026-10-30 Fix available: RHSA-2026:92213 · Red Hat
  31. 2026-10-30 Fix available: RHSA-2026:92382 · Red Hat
  32. 2026-10-30 Fix available: RHSA-2026:92214 · Red Hat
  33. 2026-10-30 Fix available: RHSA-2026:92579 · Red Hat
  34. 2026-10-30 Fix available: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux AppStream E4S (v.9.4) +4 · Red Hat
  35. 2026-10-30 Fix available: glycin-loaders@0:1.0.1-1.el10_0.1 · CNA
  36. 2026-10-30 1 new reference · CNA
  37. 2026-10-30 Fix available: RHSA-2026:92573 · Red Hat
  38. 2026-11-03 Fix available: rhai/base-image-cpu-rhel9@1793327311, rhai/base-image-cpu-rhel9@1793329709, rhai/base-image-cpu-rhel9@1793330940 +13 · CNA
  39. 2026-11-03 16 new references · CNA
  40. 2026-11-03 Fix available: RHSA-2026:94453 · Red Hat
  41. 2026-11-03 Fix available: RHSA-2026:94452 · Red Hat
  42. 2026-11-03 Fix available: RHSA-2026:94454 · Red Hat
  43. 2026-11-03 Fix available: RHSA-2026:94455 · Red Hat
  44. 2026-11-03 Fix available: RHSA-2026:94457 · Red Hat
  45. 2026-11-03 Fix available: RHSA-2026:94458 · Red Hat
  46. 2026-11-03 Fix available: RHSA-2026:94459 · Red Hat
  47. 2026-11-03 Fix available: RHSA-2026:94462 · Red Hat
  48. 2026-11-03 Fix available: RHSA-2026:94463 · Red Hat
  49. 2026-11-03 Fix available: RHSA-2026:94466 · Red Hat
  50. 2026-11-03 Fix available: RHSA-2026:94464 · Red Hat
  51. 2026-11-03 Fix available: RHSA-2026:94468 · Red Hat
  52. 2026-11-03 Fix available: RHSA-2026:94465 · Red Hat
  53. 2026-11-03 Fix available: RHSA-2026:94469 · Red Hat
  54. 2026-11-03 Fix available: RHSA-2026:94461 · Red Hat
  55. 2026-11-03 Fix available: RHSA-2026:94460 · Red Hat
  56. 2026-11-03 Fix available: Red Hat OpenShift AI 3.0, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 3.5 · Red Hat
  57. 2026-11-04 Fix available: rhai/base-image-cuda-12.9-rhel9@1793327660, rhai/base-image-cuda-13.0-rhel9@1793329271, rhai/base-image-cuda-rhel9@1793328358 +4 · CNA
  58. 2026-11-04 7 new references · CNA
  59. 2026-11-04 Fix available: RHSA-2026:94474 · Red Hat
  60. 2026-11-04 Fix available: RHSA-2026:94472 · Red Hat
  61. 2026-11-04 Fix available: RHSA-2026:94467 · Red Hat
  62. 2026-11-04 Fix available: RHSA-2026:94476 · Red Hat
  63. 2026-11-04 Fix available: RHSA-2026:94470 · Red Hat
  64. 2026-11-04 Fix available: RHSA-2026:94473 · Red Hat
  65. 2026-11-04 Fix available: RHSA-2026:94471 · Red Hat
  66. 2026-11-04 Affected versions changed · Red Hat
  67. 2026-11-04 Affected versions changed · CNA
  68. 2026-11-04 Affected versions changed · Red Hat

References

Advisory 37

Other 18

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences