Dashboard / CVE-2026-96889

CVE-2026-96889

HIGH 5 PoCs
MEDIUM Priority: 0.04 BB Relevance: 51/100
Published: 2026-09-23 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Required
S: Unchanged
C: High
I: High
A: High

Description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Weakness Classification (1)

References & Advisories (10)

https://access.redhat.com/errata/RHSA-2026:86331
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:86841
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:86842
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:86921
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:92336
vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2539279
issue-tracking x_refsource_REDHAT

Proof of Concept (5)

★ 21
https://github.com/rafabd1/VectorFreed
nomi-sec
★ 2
https://github.com/lion9453/CVE-2026-96889-nextjs-rce
nomi-sec
—
https://github.com/pauleprichna/cybersecurity
nomi-sec
—
https://github.com/AmanSin001/next-security-check
nomi-sec
—
https://github.com/CompleTech-Security/sharp-rsvg-rce-check
nomi-sec

Bug Bounty Relevance

51 / 100
✓ No authentication
✓ Low complexity
✓ PoC available (5)

CVSS Score

7.8 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.53%
Raw Score 0.005290
Percentile 44.6%
Date 2026-10-28

Intelligence Sources

mitre ref →
nvd ref →

External Links