# Red Hat RHSA-2026:86331 glycin-loaders use-after-free (CVE-2026-96889 / RUSTSEC-2026-0305, librsvg)

> CVE-2026-96889 is a use-after-free in librsvg triggered by an SVG containing nested XInclude elements that redeclare an entity already in use. Red Hat shipped an Important-rated glycin-loaders update for RHEL 10 (RHSA-2026:86331); a public PoC exists, but no in-the-wild exploitation is confirmed.

- **Published:** 2026-10-21T03:01:35Z
- **Last reviewed:** 2026-10-21T03:01:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4002
- **ID:** TL-2026-4002
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96889

## Description

CVE-2026-96889 (RUSTSEC-2026-0305) is a use-after-free (CWE-416) in librsvg, the GNOME SVG rendering library written in Rust that relies on libxml2 for XML parsing. While libxml2 is expanding an internal entity, a recursive XInclude can parse a second document that declares an entity with the same name. Both parses share the same XmlState entity map on the librsvg side. entity_insert() replaces the first entry, and the replaced entry's Drop implementation calls xmlFreeNode(), freeing a 144-byte xmlEntity structure. The outer xmlCtxtParseEntity() then keeps using the freed object.

The issue was reported upstream by Rafael B. Dias in GNOME librsvg work item 1241. The reproducer (repro.svg) uses a data URI inside an xi:include that redefines an active XML entity. The upstream fix is commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, which stops librsvg from freeing xmlEntity pointers that libxml2 still references. RustSec lists patched releases 2.63.2 and later, 2.62.4, 2.61.5, 2.60.3 and 2.57.5; other trackers cite 2.63.1 as the first upstream fix. NVD and Red Hat rate the issue CVSS 7.8 (AV:L/AC:L/PR:N/UI:R), so the victim must open or render a crafted SVG. Public sources describe the impact as denial of service or potential arbitrary code execution. No source demonstrates a working code-execution exploit.

Red Hat addressed the flaw for glycin-loaders (the image-loader component that embeds librsvg) on RHEL 10 in RHSA-2026:86331, issued 2026-10-20, rated Important. It affects RHEL 10 (x86_64, ppc64le) and the 10.2 EUS and ELS variants. Red Hat also tracks librsvg2 in Bugzilla 2539279, and Wiz lists RHEL 8, 9 and 10, Azure Linux (azl3_librsvg2 2.58.1-8) and Debian 12 as affected. Wiz reports a public PoC repository named VectorFreed that builds malicious SVGs (nested XInclude, base64 data URL, DOCTYPE entity declarations) for delivery by email, download or file share. Wiz reports no confirmed in-the-wild exploitation, the CVE is not in CISA KEV, and its EPSS is 0.00129. This record is based on vendor and tracker data only; the AUSCERT bulletin is member-gated, and no adversary, campaign or network infrastructure is associated with the flaw.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution

## Sources

- [Red Hat RHSA-2026:86331 glycin-loaders security update](https://access.redhat.com/errata/RHSA-2026:86331)
- [AUSCERT ESB-2026.12970 glycin-loaders](http://portal.auscert.org.au/bulletins/ESB-2026.12970/)
- [Red Hat CVE-2026-96889](https://access.redhat.com/security/cve/CVE-2026-96889)
- [Red Hat Bugzilla 2539279 (CVE-2026-96889)](https://bugzilla.redhat.com/show_bug.cgi?id=2539279)
- [RUSTSEC-2026-0305: Use-after-free when XML includes have duplicated entities](https://rustsec.org/advisories/RUSTSEC-2026-0305.html)
- [GNOME librsvg work item 1241](https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241)
- [Debian Security Tracker CVE-2026-96889](https://security-tracker.debian.org/CVE-2026-96889)
- [Wiz Vulnerability Database CVE-2026-96889](https://www.wiz.io/vulnerability-database/cve/cve-2026-96889)
- [VectorFreed PoC repository](https://github.com/rafabd1/VectorFreed)
- [NVD CVE-2026-96889](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-96889)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4002