Source: librsvg Version: 2.62.1+dfsg-1 Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for librsvg. CVE-2026-96889[0]: | A flaw was found in librsvg. When processing an SVG document | containing nested XML inclusions (Xincludes) with duplicate entity | declarations, a use-after-free error can occur. This vulnerability | arises because the library incorrectly frees an XML entity that is | still in use by the parser. An attacker could potentially exploit | this to cause a denial of service or execute arbitrary code. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-96889 https://www.cve.org/CVERecord?id=CVE-2026-96889 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2539279 [2] https://rustsec.org/advisories/RUSTSEC-2026-0305.html [3] https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241 [4] https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
