The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glycin-loadersUpgrade rsvg-pixbuf-loaderUpgrade librsvg2-toolsUpgrade librsvg2-develUpgrade librsvg2 | Oct 22, 2026 | Oct 21, 2026 |
| Debian | — | Upgrade librsvg | Oct 13, 2026 | Sep 23, 2026 |
| Oracle_linux | — | Upgrade librsvg2-develUpgrade librsvg2-toolsUpgrade rsvg-pixbuf-loaderUpgrade librsvg2Upgrade glycin-loaders | Oct 22, 2026 | Sep 23, 2026 |
| Redhat_linux | — | Upgrade glycin-loaders-debugsourceUpgrade librsvg2-debugsourceUpgrade librsvg2-toolsUpgrade librsvg2-develUpgrade rsvg-pixbuf-loaderNo solution existsUpgrade glycin-loadersUpgrade librsvg2-tools-debuginfoUpgrade librsvg2-debuginfoUpgrade rsvg-pixbuf-loader-debuginfoUpgrade glycin-loaders-debuginfoUpgrade librsvg2 | Sep 25, 2026 | Sep 23, 2026 |
| Rocky_linux | — | Upgrade glycin-loadersUpgrade glycin-loaders-debugsourceUpgrade librsvg2-toolsUpgrade librsvg2Upgrade rsvg-pixbuf-loader-debuginfoUpgrade glycin-loaders-debuginfoUpgrade librsvg2-debuginfoUpgrade librsvg2-debugsourceUpgrade librsvg2-tools-debuginfoUpgrade librsvg2-develUpgrade rsvg-pixbuf-loader | Oct 23, 2026 | Oct 22, 2026 |
| Ubuntu | — | Upgrade librsvg2-2 | Oct 7, 2026 | Sep 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub