Red Hat Security Advisory: librsvg2 security update

The librsvg2 packages, which provide an SVG rendering library based on libart, contain a use-after-free vulnerability triggered when XML includes have duplicated entities (CVE-2026-96889, RUSTSEC-2026-0305). Red Hat has issued a security advisory and update for Red Hat Enterprise Linux 9.8 Extended Update Support to address this flaw. The advisory references the CVE for detailed impact and scoring information. The vulnerability is classified under CWE-416 (Use After Free).

The vulnerability could lead to memory corruption due to use-after-free conditions when processing specially crafted SVG files with duplicated XML entities. Red Hat rates the security impact as Important, indicating a significant security risk that could potentially be exploited to cause denial of service or other impacts depending on context.

Red Hat has released an official security update for librsvg2 in Red Hat Enterprise Linux 9.8 Extended Update Support. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.