A use-after-free vulnerability exists in librsvg when handling SVG documents with nested Xincludes and duplicate XML entity declarations. The library incorrectly frees an XML entity still referenced by the parser, potentially allowing an attacker to cause a denial of service or execute arbitrary code. Exploitation requires user interaction. The flaw is tracked as CVE-2026-96889 and has a CVSS 3.1 base score of 7.8 (high severity). The issue is fixed upstream in librsvg 2.63.1. Red Hat Enterprise Linux 10 includes affected versions of librsvg, but no official patch is currently available from Red Hat. Users are advised to upgrade to fixed versions when available.

Successful exploitation can lead to high impact including arbitrary code execution, denial of service (application crash or restart), and potential information disclosure due to use of freed memory. The vulnerability affects confidentiality, integrity, and availability of affected systems. Exploitation requires local access and user interaction (e.g., opening a malicious SVG file).

The vulnerability has been fixed upstream in librsvg version 2.63.1. However, Red Hat currently does not provide an official patch for Red Hat Enterprise Linux 10 that meets their criteria for ease of deployment and applicability. No effective mitigation is currently available from Red Hat. Users should monitor Red Hat advisories for updates and consider upgrading to versions including the upstream fix when it becomes available.