ALSA-2026:86842: Important: librsvg2 security update

Q: What input is required to trigger the flaw?

The issue is triggered when XML includes contain duplicated entities in SVG content processed by librsvg.

Q: Which installed packages should be checked for updates?

Check the almalinux/librsvg2, almalinux/librsvg2-devel, and almalinux/librsvg2-tools packages.

Q: How can I determine whether this advisory applies to my systems?

Verify whether any of the listed AlmaLinux librsvg2 packages are installed and consult the referenced CVE, CVE-2026-96889, for affected-version and impact details.

Published Oct 21, 2026

Updated

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.

Security Fix(es):

librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

3 affected componentsFixes available

almalinux/librsvg2<2.42.7-6.el8_10

2.42.7-6.el8_10

almalinux/librsvg2-devel<2.42.7-6.el8_10

2.42.7-6.el8_10

almalinux/librsvg2-tools<2.42.7-6.el8_10

2.42.7-6.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/librsvg2 to a version that resolves this vulnerability.
Fixed in 2.42.7-6.el8_10
Upgrade
Upgrade almalinux/librsvg2-devel to a version that resolves this vulnerability.
Fixed in 2.42.7-6.el8_10
Upgrade
Upgrade almalinux/librsvg2-tools to a version that resolves this vulnerability.
Fixed in 2.42.7-6.el8_10

Event History

Oct 21, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-96889

Frequently Asked Questions

What input is required to trigger the flaw?

The issue is triggered when XML includes contain duplicated entities in SVG content processed by librsvg.

Which installed packages should be checked for updates?

Check the almalinux/librsvg2, almalinux/librsvg2-devel, and almalinux/librsvg2-tools packages.

How can I determine whether this advisory applies to my systems?

Verify whether any of the listed AlmaLinux librsvg2 packages are installed and consult the referenced CVE, CVE-2026-96889, for affected-version and impact details.

ALSA-2026:86842: Important: librsvg2 security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What input is required to trigger the flaw?

Which installed packages should be checked for updates?

How can I determine whether this advisory applies to my systems?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the flaw?

Which installed packages should be checked for updates?

How can I determine whether this advisory applies to my systems?