VectorFreed

VectorFreed Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I @rafabd1 found in librsvg CVE-2026-96889. In a Node.js/Sharp/libvips build, this bug led to command execution. It covers the bug, the paths confirmed in applications so far, and...

Rocky Linux 9.6 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.6:CLSA-2026:1787131590)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787131590 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read...

AlmaLinux 9.6 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.6:CLSA-2026:1787131590)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787131590 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read loca...

AlmaLinux 9.2 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.2:CLSA-2026:1788452050)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788452050 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read loca...

AlmaLinux 9.2 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (ALMALINUX9.2:CLSA-2024:1708416911)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1708416911 advisory. - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

RUSTSEC-2026-0305 Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

Astra Linux – Vulnerability in libxml2

A issue was discovered in libxml2 before versions 2.11.7 and 2.12.x, and even before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to a use-after-free of the xmlValidatePopElement function...

SUSE CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

AZL-99702 CVE-2026-86144 affecting package libxml2 for versions less than 2.11.5-11

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

UBUNTU-CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

EUVD-2026-71823

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...