Threats affecting pkg:cargo/librsvg/librsvg

CVE-2026-96889 is a use-after-free vulnerability in librsvg affecting Red Hat Enterprise Linux 10. It occurs when processing SVG documents with nested XML inclusions containing duplicate entity declarations, causing the library to free an XML entity still in use. This flaw can lead to denial of service or arbitrary code execution. Exploitation requires user interaction, such as opening a malicious SVG file. The issue is fixed in librsvg version 2.63.1.