Loading vulnerability…
CVE-2026-96889 is a use-after-free vulnerability in librsvg's processing of SVG documents containing nested XML XIncludes with duplicate entity declarations. The library can free an XML entity while the parser continues to use it, resulting in access to freed memory. Processing a crafted SVG can therefore trigger memory corruption.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This three-file repository contains documentation and one standalone Python 3 proof-of-concept generator, pocs/poc-uaf.py. The generator constructs an outer SVG with a DTD entity that expands to an XInclude element and embeds an inner SVG as a data URL. The inner SVG redeclares the same entity name, targeting a librsvg/libxml2 lifetime error described as CVE-2026-96889. It can emit raw SVG, an SVG data URL, or an XML text-injection fragment, then optionally Base64-, JSON-string-, or URL-encode the result for delivery through differing application inputs. The repository is a trigger/crash-validation PoC rather than an RCE exploit: it contains no networking client, listener, command payload, heap-grooming logic, or target-specific request automation. README material describes a possible downstream Next.js/Satori/Sharp/libvips route and CVE-2026-94545, but that route is not implemented in code.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability tracked as CVE-2026-96889 affecting Fedora 45's librsvg2, rust-librsvg, and rust-xml5ever packages.
A critical network-reachable vulnerability affecting listed glycin-loaders and librsvg2-related packages on CentOS 7/8 and Red Hat Enterprise Linux 7/8/9/10. The supplied CVSS v3 vector indicates low-complexity, unauthenticated remote exploitation with high confidentiality, integrity, and availability impact.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.