Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft SVG with nested XIncludes + duplicate entity decls
  2. Delivery
    Deliver file to victim (email/download/share)
  3. Exploit
    Victim opens or previews in GTK app
  4. Execution
    Parser frees in-use XML entity
  5. Persist
    Use-after-free corrupts heap
  6. Impact
    Process crash or potential code execution

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to render a specifically malformed SVG document that combines nested XML inclusions (XInclude directives) with duplicate entity declarations - that specific structure is what triggers the parser to free an in-use XML entity. Delivery depends on user interaction (UI:R): the victim must open, preview, or thumbnail the file in an application that uses librsvg, so the vector is local (AV:L), not remote-network. Limiting factors: no authentication is bypassed but the attack cannot fire without a user action against a crafted file, the arbitrary-code-execution outcome is unproven (only crash/DoS is reliably reachable), and no fixed librsvg version is stated in the available data.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8, Red Hat-reported) describes a local attack vector requiring user interaction: an attacker cannot reach this over the network directly but must get a victim to render a crafted SVG. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis'. The C:H/I:H/A:H impact rests on the description's claim that the use-after-free 'could potentially... execute arbitrary code' - that arbitrary-code-execution outcome is speculative/vendor-hedged language, whereas the denial-of-service (crash) outcome is the reliably reachable impact from a CWE-416 free-in-use bug. The genuine risk driver is librsvg's enormous, silent deployment footprint (GNOME/GTK thumbnailers, image viewers, file managers auto-render SVGs), which converts UI:R into near-automatic triggering the moment a malicious SVG lands in a browsed directory. Net: not an emergency patch-tonight item given the local vector, required interaction, and absence of KEV/POC/EPSS and unproven RCE - but a should-patch-promptly issue because of ubiquity and the passive-open trigger surface.
Exploit ScenarioDerived

An attacker crafts an SVG file containing nested XInclude directives with duplicate XML entity declarations and delivers it via email attachment, download, or a shared folder. When the victim opens or merely previews the file in a GNOME/GTK application (thumbnailer, image viewer, or file manager), librsvg frees an XML entity still in use by the parser, crashing the process (DoS) and potentially - per the vendor's hedged description - enabling arbitrary code execution. No public exploit code is identified in the provided data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
1 public PoC Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity declarations allows unauthenticated local attackers to crash or potentially execute code in applications that use the library. Tracked as CVE-2026-96889 and reported by Red Hat, the flaw affects librsvg as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. Exploitation requires user interaction (UI:R) because a victim must open, preview, or thumbnail a malicious SVG; the CVSS 3.1 score is 7.8. No public exploit code was identified at time of analysis, and independent assessment indicates that arbitrary code execution is unproven-only denial of service or crash is reliably reachable.

RemediationAI

No vendor-released patch is identified in the available data. Monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-96889), the upstream GitLab work item (https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241), and the RustSec advisory (https://rustsec.org/advisories/RUSTSEC-2026-0305.html) for a fixed librsvg version. Until a patch is available, avoid opening or previewing untrusted SVG files, especially those containing XInclude directives, and configure applications to disable SVG thumbnail generation or automatic rendering. If your use case allows, disable XInclude processing in the XML parser-though librsvg does not expose a direct toggle, wrapping the library in a sandbox (e.g., seccomp, AppArmor) or running the rendering process with reduced privileges limits the impact of memory corruption. Be aware that these compensating controls may reduce functionality or require application changes.

Affected Packages

cargo librsvg fix: 2.57.5, 2.60.3, 2.61.5, 2.62.4, 2.63.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

librsvg is a Rust-based library for rendering SVG (Scalable Vector Graphics) images, widely used in GNOME and other Linux desktop environments, and also available as a crate on crates.io. The flaw is a use-after-free (CWE-416) triggered when the XML parser processes nested XInclude directives alongside duplicate entity declarations: the library frees an XML entity object that the parser still references, leading to memory corruption. The CPE data lists affected Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10. The underlying issue involves improper memory management during XML entity expansion, a known risk class that can be manipulated to influence control flow or crash the process.

Know when Librsvg gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local file-render vector needing victim interaction (AV:L/UI:R/PR:N); high impacts retained per vendor UAF-to-RCE claim though arbitrary-code-execution is speculative and only DoS is proven.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Technical POC Analysis

Evidence caveat: the supplied material is a single automated CVE report (gist GHSA-WQ5F-XC86-PV6W).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Latest POC

1 public PoC link from github

Sign in to open the public PoC links collected for this CVE.

Sign in to read

Executive ViewAI

Why It Matters

A memory-safety flaw in librsvg, the SVG rendering library shipped across Red Hat Enterprise Linux 6 through 10 and embedded in many desktop and server applications, can be triggered when a user opens, previews, or thumbnails a maliciously crafted SVG file. Reliable impact observed so far is application crash or denial of service, though code execution cannot be ruled out; no public exploit has been identified and no vendor patch is yet available. Because librsvg is a ubiquitous shared dependency rather than a single product, remediation depends on distribution-level updates, and the practical exposure for most organizations is on Linux workstations and any service that processes untrusted SVG content.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include disabling SVG thumbnail and preview generation, removing or disabling the librsvg gdk-pixbuf SVG loader on exposed hosts, blocking or sandboxing untrusted SVG input in server-side and automated processing pipelines, restricting user ability to open untrusted SVG files, and monitoring librarian-linked applications for abnormal crashes.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
Ubiquitous
librsvg underpins SVG rendering across GNOME/GTK on virtually all Linux desktops
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Librsvg

View all
CVE-2023-38633 MEDIUM POC
5.5 Jul 22

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to

CVE-2018-1000041 HIGH
8.8 Feb 09

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulner
CVE-2016-4348 HIGH
7.5 May 20

The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of ser
CVE-2017-11464 HIGH
7.8 Jul 19

A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of

CVE-2015-7558 HIGH
7.5 May 20

librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption
CVE-2015-7557 HIGH
7.5 May 20

The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to

CVE-2013-1881 MEDIUM
4.3 Oct 10

GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external en
CVE-2016-6163 MEDIUM
5.5 Feb 03

The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a deni

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/409205 REF https://access.redhat.com/security/cve/CVE-2026-96889 REF https://bugzilla.redhat.com/show_bug.cgi?id=2539279 REF https://crates.io/crates/librsvg REF https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241 REF https://rustsec.org/advisories/RUSTSEC-2026-0305.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy