Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
librsvg may crash or run malicious code
published 29 days ago
Summary
The librsvg library, used to display SVG images, can be tricked by specially crafted files that contain duplicate XML definitions. This can cause the program to stop working or potentially run unwanted code. Update librsvg to the latest version or apply the vendor's security patch to prevent these attacks.
What to do
- Update canonical librsvg to version 2.58.0+dfsg-1ubuntu0.1.
- Update canonical librsvg to version 2.61.3+dfsg-3ubuntu0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:24.04:LTS | canonical | librsvg |
< 2.58.0+dfsg-1ubuntu0.1 Fix: upgrade to 2.58.0+dfsg-1ubuntu0.1
|
| Ubuntu:26.04:LTS | canonical | librsvg |
< 2.61.3+dfsg-3ubuntu0.1 Fix: upgrade to 2.61.3+dfsg-3ubuntu0.1
|
Original advisory text
librsvg vulnerability
It was discovered that librsvg incorrectly handled duplicate XML entity
declarations while processing SVG documents containing nested XML
inclusions. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code.
declarations while processing SVG documents containing nested XML
inclusions. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code.
References
- https://ubuntu.com/security/notices/USN-8891-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-96889 Third Party Advisory
Timeline
Published6 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
USN-8891-1 · OSV
Track software like this
Free during beta