Hi,

The following vulnerability was published for librsvg.

CVE-2026-96889[0]:
| A flaw was found in librsvg. When processing an SVG document
| containing nested XML inclusions (Xincludes) with duplicate entity
| declarations, a use-after-free error can occur. This vulnerability
| arises because the library incorrectly frees an XML entity that is
| still in use by the parser. An attacker could potentially exploit
| this to cause a denial of service or execute arbitrary code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-96889
https://www.cve.org/CVERecord?id=CVE-2026-96889
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2539279
[2] https://rustsec.org/advisories/RUSTSEC-2026-0305.html
[3] https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
[4] https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore