Hi,

The following vulnerability was published for librsvg.

CVE-2026-96889[0]:
| A flaw was found in librsvg. When processing an SVG document
| containing nested XML inclusions (Xincludes) with duplicate entity
| declarations, a use-after-free error can occur. This vulnerability
| arises because the library incorrectly frees an XML entity that is
| still in use by the parser. An attacker could potentially exploit
| this to cause a denial of service or execute arbitrary code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-96889
https://www.cve.org/CVERecord?id=CVE-2026-96889
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2539279
[2] https://rustsec.org/advisories/RUSTSEC-2026-0305.html
[3] https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241
[4] https://gitlab.gnome.org/GNOME/librsvg/-/commit/8a1b0cd319e9af2d1e9cf878081dd77f227a0504

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
librsvg, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148902@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated librsvg package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 Oct 2026 13:22:08 +0200
Source: librsvg
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.63.2+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1148902
Changes:
 librsvg (2.63.2+dfsg-1) unstable; urgency=medium
 .
   * New upstream release
     - SECURITY UPDATE: Fix use-after-free when processing SVG with Xincludes
       - CVE-2026-96889 (Closes: #1148902)
   * Create a vendor rule in debian/rules instead of a list of commands
     to run in debian/README.source
   * debian/rules: Update test .a file handling
   * Update vendored rust crates
   * Update debian/source/include-binaries
   * Remove obsolete pango workaround patch
   * Update minimum pango
   * Update debhelper compat to 14
   * Run wrap-and-sort -ast
Checksums-Sha1:
 f3e7eb5badbf44cfd0ba4fdf67326b3c04e89ee5 2955 librsvg_2.63.2+dfsg-1.dsc
 f5b06c048dc82210c272c787ca263ff413c56988 6760720 librsvg_2.63.2+dfsg.orig.tar.xz
 9b989b9ddd1a19fe7b0aa6f8d4ab14d21fe5ddcb 14086564 librsvg_2.63.2+dfsg-1.debian.tar.xz
 4fc9d78c58fc031cf421946aa87742bdbca01cf5 9757 librsvg_2.63.2+dfsg-1_source.buildinfo
Checksums-Sha256:
 48c717224e2da63520c34658b34cab721b400fcb5b87a28a70647696aedd4062 2955 librsvg_2.63.2+dfsg-1.dsc
 7adba68a78ad1d4ee2648dbbae51e50441b8ae20fa7b7b351dd3d0084ebe6e0d 6760720 librsvg_2.63.2+dfsg.orig.tar.xz
 2778b88bfae17862f97505bae64b41af3f0a0a8838e3cba24465f3e256589ded 14086564 librsvg_2.63.2+dfsg-1.debian.tar.xz
 e61115cbd77d76d3c0bf69dd1bb1f63f6c3498fa8c92681b24af33345f1ae4de 9757 librsvg_2.63.2+dfsg-1_source.buildinfo
Files:
 a3778e90d31c2e84a50648b9fbcc888b 2955 libs optional librsvg_2.63.2+dfsg-1.dsc
 29a3b4a39936af3a2b20e176cd732491 6760720 libs optional librsvg_2.63.2+dfsg.orig.tar.xz
 928bb949869e497e2a441129a8b96ed0 14086564 libs optional librsvg_2.63.2+dfsg-1.debian.tar.xz
 57c700139192931e1a15a386a16e9f81 9757 libs optional librsvg_2.63.2+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrA6F0ACgkQ5mx3Wuv+
bH2kzhAAybnd4qXZfZBAAeTHRcdSRCPKVRpfxYHxnb3y42k5WFlm8nz3bUdJo7lu
kXJ3+bOIeDJc74jb2WJNn8PXXDFIHIZo/C3j8A51Oop7ZSXy9PRSHXN/if0v4sAy
1gTlZYN/UM/jU/ComB1vQVAsl/VeT8mItPzNi4YBgUdax3iA9GN+KFV+ojFzp8ym
hNqRI4ygPlu96CltbpfOY5qmYWce+R41uYOSTVhQdglvN6FG16NP73AdKGhkk2Dm
yNfrrDsmm6oBluR4ZaV+j/jeiikGk2ch+RoO2AE4+R2M1+eZMl9ndh29MD+9g36Q
ySRplSP4LlVEs8rn3C6htcuXU5ZYGYHrP+qN0O/yA9+rdbHgipuzGpviWkidCLw2
4mgaPo9GHCUCcQKIW1VftEbNQ3IcVyLSVlk/9BJFlhidh9/X/V10UC+DV0FlCP5O
85N28IdH1+AzaUVCPpAyp0cMqjHKxzcyZpd6RytAZ7vhoc4vM/5rwBJq6ygjVnEP
dkrzerQANlPrY/9XzVy8ui2gY801dW3FJk4W4VYnQU/iQdOVqdZi0agqwghBbBAC
NUG9/7SP12K6KxpLhO0b9bt7Zsxna+CWATRTT9vqMxRzteFFtXnSgAfXML9PLACA
fVnyHmsOJUnMDyPvwIh5pHcs2hCPPkak741hv0BjMGTcyH++91M=
=p0KK
-----END PGP SIGNATURE-----