CVE-2026-96889

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse1 post

sy.br1d@rafabd1_1d
Esse exploit está correto pra CVE-2026-94545, também adicionei ele ao repo http://github.com/rafabd1/VectorFreed junto com o PoC da CVE-2026-96889 que é falha raiz por trás deste RCE (que ainda afeta dezenas de produtos e curiosamente quase ninguém falou sobre mas ok) Mas vale destacar tbm que o exploit do RCE é muito dependente do layout da stack usada para executar o librsvg, não é universal e tbm ainda não temos um bypass de ASLR. Por isso o ideal é usar o exploit do UAF para validação inicial
05060346.2K
1.9K followersView on X

Explore more

Back to dashboard