Hi,

The following vulnerability was published for librsvg.

CVE-2026-96889[0]:
| A flaw was found in librsvg. When processing an SVG document
| containing nested XML inclusions (Xincludes) with duplicate entity
| declarations, a use-after-free error can occur. This vulnerability
| arises because the library incorrectly frees an XML entity that is
| still in use by the parser. An attacker could potentially exploit
| this to cause a denial of service or execute arbitrary code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-96889
https://www.cve.org/CVERecord?id=CVE-2026-96889
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2539279
[2] https://rustsec.org/advisories/RUSTSEC-2026-0305.html
[3] https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
[4] https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148902@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated librsvg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 Oct 2026 13:22:08 +0200
Source: librsvg
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.63.2+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1148902
Changes:
 librsvg (2.63.2+dfsg-1) unstable; urgency=medium
 .
   * New upstream release
     - SECURITY UPDATE: Fix use-after-free when processing SVG with Xincludes
       - CVE-2026-96889 (Closes: #1148902)
   * Create a vendor rule in debian/rules instead of a list of commands
     to run in debian/README.source
   * debian/rules: Update test .a file handling
   * Update vendored rust crates
   * Update debian/source/include-binaries
   * Remove obsolete pango workaround patch
   * Update minimum pango
   * Update debhelper compat to 14
   * Run wrap-and-sort -ast
Checksums-Sha1:
 f3e7eb5badbf44cfd0ba4fdf67326b3c04e89ee5 2955 librsvg_2.63.2+dfsg-1.dsc
 f5b06c048dc82210c272c787ca263ff413c56988 6760720 librsvg_2.63.2+dfsg.orig.tar.xz
 9b989b9ddd1a19fe7b0aa6f8d4ab14d21fe5ddcb 14086564 librsvg_2.63.2+dfsg-1.debian.tar.xz
 4fc9d78c58fc031cf421946aa87742bdbca01cf5 9757 librsvg_2.63.2+dfsg-1_source.buildinfo
Checksums-Sha256:
 48c717224e2da63520c34658b34cab721b400fcb5b87a28a70647696aedd4062 2955 librsvg_2.63.2+dfsg-1.dsc
 7adba68a78ad1d4ee2648dbbae51e50441b8ae20fa7b7b351dd3d0084ebe6e0d 6760720 librsvg_2.63.2+dfsg.orig.tar.xz
 2778b88bfae17862f97505bae64b41af3f0a0a8838e3cba24465f3e256589ded 14086564 librsvg_2.63.2+dfsg-1.debian.tar.xz
 e61115cbd77d76d3c0bf69dd1bb1f63f6c3498fa8c92681b24af33345f1ae4de 9757 librsvg_2.63.2+dfsg-1_source.buildinfo
Files:
 a3778e90d31c2e84a50648b9fbcc888b 2955 libs optional librsvg_2.63.2+dfsg-1.dsc
 29a3b4a39936af3a2b20e176cd732491 6760720 libs optional librsvg_2.63.2+dfsg.orig.tar.xz
 928bb949869e497e2a441129a8b96ed0 14086564 libs optional librsvg_2.63.2+dfsg-1.debian.tar.xz
 57c700139192931e1a15a386a16e9f81 9757 libs optional librsvg_2.63.2+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrA6F0ACgkQ5mx3Wuv+
bH2kzhAAybnd4qXZfZBAAeTHRcdSRCPKVRpfxYHxnb3y42k5WFlm8nz3bUdJo7lu
kXJ3+bOIeDJc74jb2WJNn8PXXDFIHIZo/C3j8A51Oop7ZSXy9PRSHXN/if0v4sAy
1gTlZYN/UM/jU/ComB1vQVAsl/VeT8mItPzNi4YBgUdax3iA9GN+KFV+ojFzp8ym
hNqRI4ygPlu96CltbpfOY5qmYWce+R41uYOSTVhQdglvN6FG16NP73AdKGhkk2Dm
yNfrrDsmm6oBluR4ZaV+j/jeiikGk2ch+RoO2AE4+R2M1+eZMl9ndh29MD+9g36Q
ySRplSP4LlVEs8rn3C6htcuXU5ZYGYHrP+qN0O/yA9+rdbHgipuzGpviWkidCLw2
4mgaPo9GHCUCcQKIW1VftEbNQ3IcVyLSVlk/9BJFlhidh9/X/V10UC+DV0FlCP5O
85N28IdH1+AzaUVCPpAyp0cMqjHKxzcyZpd6RytAZ7vhoc4vM/5rwBJq6ygjVnEP
dkrzerQANlPrY/9XzVy8ui2gY801dW3FJk4W4VYnQU/iQdOVqdZi0agqwghBbBAC
NUG9/7SP12K6KxpLhO0b9bt7Zsxna+CWATRTT9vqMxRzteFFtXnSgAfXML9PLACA
fVnyHmsOJUnMDyPvwIh5pHcs2hCPPkak741hv0BjMGTcyH++91M=
=p0KK
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148902@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Moritz Mühlenhoff <jmm@debian.org> (supplier of updated librsvg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 07 Oct 2026 00:03:53 +0200
Source: librsvg
Architecture: source
Version: 2.60.0+dfsg-1+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Moritz Mühlenhoff <jmm@debian.org>
Closes: 1148902
Changes:
 librsvg (2.60.0+dfsg-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-96889 (Closes: #1148902)
Checksums-Sha1:
 202c730587c076f7c93b2c579bc5abf4c05b41cb 3089 librsvg_2.60.0+dfsg-1+deb13u1.dsc
 d5bede0ff479277fc8578bc89f328de79290fbfd 6735208 librsvg_2.60.0+dfsg.orig.tar.xz
 5c20fd47882d4627d52567c3431fc149311a6aeb 10833628 librsvg_2.60.0+dfsg-1+deb13u1.debian.tar.xz
 b606b96d71b6b8a5d036adb7d113318a4fb87f24 16154 librsvg_2.60.0+dfsg-1+deb13u1_amd64.buildinfo
Checksums-Sha256:
 1653a531d1e0374318197cc008c3b9a4286d5e178d34c52a38f2b867d4f56fc2 3089 librsvg_2.60.0+dfsg-1+deb13u1.dsc
 1b9f126ad3115e4126c682f3011023a05dcf19a69e5e878fbffb420ade671b81 6735208 librsvg_2.60.0+dfsg.orig.tar.xz
 8ba361c954a3337a0257ce46960bfc874c99912381b9342a475db6c6422203bf 10833628 librsvg_2.60.0+dfsg-1+deb13u1.debian.tar.xz
 7dbffe4d1142bfea2a908578688bb57f981c0f49b160af3b716c14ab6ba3ae2e 16154 librsvg_2.60.0+dfsg-1+deb13u1_amd64.buildinfo
Files:
 7d08d16f04427f870d116182b24e13ac 3089 libs optional librsvg_2.60.0+dfsg-1+deb13u1.dsc
 81c109a434a07a979ef33b3294d5e447 6735208 libs optional librsvg_2.60.0+dfsg.orig.tar.xz
 794c5ba3e03ddc856fd0ae1c1daebc9c 10833628 libs optional librsvg_2.60.0+dfsg-1+deb13u1.debian.tar.xz
 13247c1cc7be116accfc586e4ee14a05 16154 libs optional librsvg_2.60.0+dfsg-1+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmrGiZEACgkQEMKTtsN8
Tja9SQ//UDqnGxuMhcjHRlbITvbgOAyNBPL0ywLTelG7hQPv8boQydjTBPTBeI2C
3vSlif9LOCVFmrQQyZlNlsiUKUy5CdgZ+MJw3/BYmChtEe3sZvmZMKm/tV+V04X0
hWWG9BFbMCMmEZTV7bor8ycrtWrse4r15gSDWT9k39tmBEdu015vgnXdYJMgYUNw
lsB3THpwkZoy3Ws9DmEZ+iHfNTNIYiYv4DbfIkhqJU6dHi9xafkB2TiNszgQJdkc
yVIHDDemko36wHUPccxSNbTARF1jE5q/HCvPAmovX0GGuBo9HGCuDMArcwtRaSJx
di46pf8ZnDnSsGpdLlcRyWSc2UDPoML87SO9yDNXZqd3Q6TAfxrkXDOi6yhUGE4z
SXdEJJVlch34tq+VgKwKJoWsA7gspOte/FLknpDb3p3vkSwLzQuBgmnun01cK3vL
N/HZRSkqeepU0eLQRBkXs8lwfjohjv1G3b+8EeISo07JMTyStnAtV/0F1sTGWQ+q
eSn7OY/RF7r2WpjmdyTlQXoQmxhe+e5WJ8C2ygDWsEjvKdMDT9/Q3/4/qpbpzmeu
gfj+ry5KFWqaZqbFV1S6ff3gL1eVMx9CJmzC2EdszRpjhkQzeOUMu0W6Wpp0boUY
EXaTqzxkA2IhzM8SHOwjA+CSfEmyLVZziltD0Fb9P4JFni1at9M=
=5cKZ
-----END PGP SIGNATURE-----