Threats affecting pkg:generic/librsvg

CVE-2026-86969 is a vulnerability in Apple iOS, iPadOS, and macOS that involves an out-of-bounds write due to insufficient input validation. This flaw could allow a malicious app to cause unexpected system termination or corrupt kernel memory. The issue has been addressed and fixed in iOS and iPadOS versions 26.7.2 and 27.2, as well as macOS Golden Gate 27.2, Sequoia 15.8.2, and Tahoe 26.7.2.

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.

A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

A use-after-free vulnerability in Apple Safari could cause the browser to crash when processing maliciously crafted web content. This issue has been addressed with improved memory management and fixed in Safari 27.2, iOS 26.7.2, iPadOS 26.7.2, and related Apple operating system versions.

A vulnerability in Apple macOS allows an app to read files outside of its sandbox due to insufficient access restrictions. This issue has been addressed and fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.

CVE-2026-65384 is an out-of-bounds read vulnerability in Apple macOS that could allow a remote attacker to cause an unexpected process termination. The issue was addressed by improved input validation and fixed in macOS Golden Gate version 27.2.

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An attacker in physical proximity may be able to corrupt process memory.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (1bbe1eb2e2e46c8aa452e19060d6f37d8e744e62e5c58be091c4e1f263a09d1a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

A vulnerability in Apple iOS and iPadOS allowed a malicious app to access the camera without user permission. This access issue was addressed by Apple with improved access restrictions. The flaw is fixed in iOS and iPadOS versions 18.7.11, 26.7.2, and 27.2, as well as corresponding macOS and visionOS versions.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.

CVE-2026-65392 is a permissions vulnerability in Apple macOS where an app with root privileges could access private information. The issue was addressed by adding additional restrictions and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify protected parts of the file system.

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to unexpected app termination.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.