CVE-2026-96889: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-96889 is a use-after-free vulnerability in librsvg, the GNOME SVG rendering library, triggered when processing SVG documents containing nested XML inclusions (XIncludes) with duplicate entity declarations. The flaw causes librsvg to incorrectly free an XML entity still in use by the parser, potentially enabling denial of service or arbitrary code execution. Affected products include librsvg2 and glycin-loaders as distributed by Red Hat, with the upstream fix available in librsvg version 2.63.1. It was disclosed on September 23, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a use-after-free (CWE-416) in librsvg's interaction with libxml2, the underlying C XML parsing library. When librsvg processes an SVG with a nested XInclude, a recursive parse of an included document can declare an XML entity with the same name as one already registered in the shared XmlState entity map. The entity_insert() function replaces the first entry and calls xmlFreeNode() via its Drop implementation, but the outer xmlCtxtParseEntity() call continues referencing the now-freed 144-byte xmlEntity struct. The upstream fix (commit 8a1b0cd319e9af2d1e9af2d1e9cf878081dd77f227a0504) prevents librsvg from freeing xmlEntity pointers that libxml2 is still actively using (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in a crash (denial of service) or, in more severe scenarios, arbitrary code execution on the affected system. Because the vulnerability involves a freed heap object being reused, an attacker who can control the contents of the freed memory region may be able to redirect execution flow, read sensitive memory, or corrupt data. The attack vector is local and requires user interaction — specifically, a user must open a maliciously crafted SVG file — limiting the blast radius compared to network-exploitable flaws, but the high confidentiality, integrity, and availability impacts make it significant for desktop and server environments that render untrusted SVG content (Red Hat CVE).

As of the disclosure date (September 23, 2026), no public proof-of-concept exploit code or in-the-wild exploitation has been reported, and the EPSS score is 0.0 (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (opening a malicious SVG file) and is local in nature, which reduces the likelihood of opportunistic mass exploitation. The vulnerability was reported by Rafael B. Dias and is also tracked as RUSTSEC-2026-0305 (Red Hat Bugzilla).

1. Craft a malicious SVG file: Create an SVG document that uses nested XInclude directives (<xi:include>) pointing to an external or embedded XML document. Within the included document, declare an XML entity using the same name as one already declared in the outer document's entity map.
2. Trigger the duplicate entity registration: When librsvg parses the outer SVG and encounters the XInclude, it recursively parses the included document. The entity_insert() call replaces the existing entity entry in the shared XmlState map, invoking xmlFreeNode() on the original entity struct.
3. Exploit the use-after-free: The outer parser's xmlCtxtParseEntity() continues to reference the now-freed xmlEntity memory (144 bytes). Depending on heap layout and timing, this freed region may be reallocated with attacker-controlled data.
4. Achieve denial of service or code execution: If the freed memory is reclaimed and overwritten with crafted content before the outer parser accesses it, an attacker may redirect function pointers or corrupt heap metadata to achieve arbitrary code execution. At minimum, the invalid memory access causes a crash.
5. Deliver the payload: Distribute the malicious SVG via email attachment, web download, or embedded in a document, and social-engineer the target user into opening it with an application that uses librsvg for rendering (e.g., GNOME image viewers, Nautilus thumbnailing, Inkscape) (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of unexpected or suspicious .svg files in download directories, email attachments, or temporary folders; files with deeply nested <xi:include> directives and duplicate XML entity declarations.
• Process: Abnormal crashes or segmentation faults in processes that render SVG content (e.g., eog, nautilus, inkscape, gdk-pixbuf-thumbnailer, glycin); unexpected child processes spawned from SVG-rendering applications.
• Logs: System logs (/var/log/syslog, journalctl) showing segfault signals (signal 11) or heap corruption errors originating from librsvg or libxml2; core dump files generated by SVG-rendering processes.
• Network: Outbound connections from SVG-rendering processes to unexpected external hosts (indicative of post-exploitation activity such as reverse shell or data exfiltration) (Red Hat CVE).

The upstream fix is available in librsvg version 2.63.1, which prevents librsvg from freeing xmlEntity pointers still in use by libxml2. Red Hat has noted that no practical configuration-based workaround is currently available that meets their deployment criteria (Red Hat CVE). Users should upgrade librsvg/librsvg2 and glycin-loaders to patched versions as soon as they become available in their distribution's package repositories. As an interim measure, avoid opening untrusted SVG files with applications that use librsvg for rendering, and consider disabling SVG thumbnail generation in file managers.

The vulnerability was acknowledged by Red Hat Product Security, which classified it as "Important" and credited Rafael B. Dias for the report (Red Hat CVE). It is also tracked in the Rust security advisory database as RUSTSEC-2026-0305, reflecting the Rust ecosystem's attention to memory safety issues in libraries that interface with C code (Red Hat Bugzilla). Social media activity was limited, with brief mentions on Mastodon via RedPacketSecurity shortly after disclosure.