{"id":"ghsa-ghsa-cpvr-w4j5-2mpg","seq":309599,"kind":"advisory","title":"Librsvg: Use-after-free when XML includes have duplicated entities","url":"https://github.com/advisories/GHSA-cpvr-w4j5-2mpg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cpvr-w4j5-2mpg","summary":"影響: rust:librsvg < 2.57.5 → 2.57.5, rust:librsvg >= 2.60.0-beta.0, < 2.60.3 → 2.60.3, rust:librsvg >= 2.61.0, < 2.61.5 → 2.61.5, rust:librsvg >= 2.62.0-beta.0, < 2.62.4 → 2.62.4, rust:librsvg >= 2.63.0-beta.0, < 2.63.2 → 2.63.2\nLibrsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse another document that declares an entity with the same name. Both parses use the same XmlState entity map on the librsvg side. entity_insert() replaces the first entry, whose Drop implementation calls xmlFr…","severity":"high","techs":["rust"],"cves":["CVE-2026-96889"],"tags":["GHSA-cpvr-w4j5-2mpg","librsvg","librsvg","librsvg","librsvg","librsvg"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T15:52:48.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}