RHSA-2026:98482: Important: librsvg2 security update

Q: What input is required to trigger the flaw?

The issue is triggered when SVG-related XML processing handles includes containing duplicated entities. An attacker would need to cause a vulnerable librsvg installation to process such crafted XML content.

Q: Which installed packages should be considered in scope?

The advisory lists librsvg2 and its debuginfo, debugsource, development, tools, and tools-debuginfo packages. Systems with any of these Red Hat package variants installed should review and apply the security update.

Q: How can I determine whether the update is relevant to my environment?

Check whether the listed librsvg2 packages are installed and whether your applications or workflows process SVG or XML content through librsvg. The provided information does not identify affected version ranges, so compare installed package updates with the RHSA-2026:98482 erratum.

Published Nov 11, 2026

Updated

The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.Security Fix(es): librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

24 affected componentsFixes available

redhat/librsvg2<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-debuginfo<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-debuginfo<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-debugsource<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-debugsource<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-devel<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-devel<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-tools<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-tools-debuginfo<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-tools-debuginfo<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-tools<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-debuginfo<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-debugsource<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-devel<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-tools<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2-tools-debuginfo<2.50.7-3.el9_9.1

2.50.7-3.el9_9.1

redhat/librsvg2<2.50.7-3.el9_9.1.aa

2.50.7-3.el9_9.1.aa

redhat/librsvg2-debuginfo<2.50.7-3.el9_9.1.aa

2.50.7-3.el9_9.1.aa

redhat/librsvg2-debugsource<2.50.7-3.el9_9.1.aa

2.50.7-3.el9_9.1.aa

redhat/librsvg2-devel<2.50.7-3.el9_9.1.aa

2.50.7-3.el9_9.1.aa

redhat/librsvg2-tools<2.50.7-3.el9_9.1.aa

2.50.7-3.el9_9.1.aa

redhat/librsvg2-tools-debuginfo<2.50.7-3.el9_9.1.aa

2.50.7-3.el9_9.1.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/librsvg2 to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1
Upgrade
Upgrade redhat/librsvg2-debuginfo to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1
Upgrade
Upgrade redhat/librsvg2-debugsource to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1
Upgrade
Upgrade redhat/librsvg2-devel to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1
Upgrade
Upgrade redhat/librsvg2-tools to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1
Upgrade
Upgrade redhat/librsvg2-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1
Upgrade
Upgrade redhat/librsvg2 to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1.aa
Upgrade
Upgrade redhat/librsvg2-debuginfo to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1.aa
Upgrade
Upgrade redhat/librsvg2-debugsource to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1.aa
Upgrade
Upgrade redhat/librsvg2-devel to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1.aa
Upgrade
Upgrade redhat/librsvg2-tools to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1.aa
Upgrade
Upgrade redhat/librsvg2-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 2.50.7-3.el9_9.1.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What input is required to trigger the flaw?

The issue is triggered when SVG-related XML processing handles includes containing duplicated entities. An attacker would need to cause a vulnerable librsvg installation to process such crafted XML content.

Which installed packages should be considered in scope?

The advisory lists librsvg2 and its debuginfo, debugsource, development, tools, and tools-debuginfo packages. Systems with any of these Red Hat package variants installed should review and apply the security update.

How can I determine whether the update is relevant to my environment?

Check whether the listed librsvg2 packages are installed and whether your applications or workflows process SVG or XML content through librsvg. The provided information does not identify affected version ranges, so compare installed package updates with the RHSA-2026:98482 erratum.

RHSA-2026:98482: Important: librsvg2 security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What input is required to trigger the flaw?

Which installed packages should be considered in scope?

How can I determine whether the update is relevant to my environment?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the flaw?

Which installed packages should be considered in scope?

How can I determine whether the update is relevant to my environment?