CVE-2026-96889

2 advisories.

crates.io/librsvg CVE-2026-96889: high 7.8

Librsvg: Use-after-free when XML includes have duplicated entities

Action: Upgrade librsvg to 2.57.5 or later.

cargo update -p librsvg --precise 2.57.5

cargo update -p librsvg --precise 2.60.3

cargo update -p librsvg --precise 2.61.5

cargo update -p librsvg --precise 2.62.4

cargo update -p librsvg --precise 2.63.2

Affected

introduced	fixed	last affected
0	2.57.5	-
2.60.0-beta.0	2.60.3	-
2.61.0	2.61.5	-
2.62.0-beta.0	2.62.4	-
2.63.0-beta.0	2.63.2	-

Fixed versions

2.57.5

2.60.3

2.61.5

2.62.4

2.63.2

Sources

CVE-2026-96889 · published 2026-10-22T15:52:48Z · modified 2026-10-22T16:10:47.016154710Z · JSON

crates.io/librsvg CVE-2026-96889: high 7.8

Use-after-free when XML includes have duplicated entities

Action: Upgrade librsvg to 2.57.5 or later.

cargo update -p librsvg --precise 2.57.5

cargo update -p librsvg --precise 2.60.3

cargo update -p librsvg --precise 2.61.5

cargo update -p librsvg --precise 2.62.4

cargo update -p librsvg --precise 2.63.2

Affected

introduced	fixed	last affected
0.0.0-0	2.57.5	-
2.57.90	2.60.3	-
2.61.0	2.61.5	-
2.61.90	2.62.4	-
2.62.90	2.63.2	-

Fixed versions

2.57.5

2.60.3

2.61.5

2.62.4

2.63.2

Sources

CVE-2026-96889 · published 2026-09-23T12:00:00Z · modified 2026-10-22T16:10:47.016154710Z · JSON