                              
            .....             
        .                     
                    ::        
                      .       
                     #*       
   :                 #*       
                     #*       
                     #*       
   #                :..  :    
   #                :::  .::  
   #                 **       
   #                 **       
   *                 **:      
   *  ::   :: ####::  **      
          :  :***:  : **      
   ..         ...

                              
                              
          %%%%%%%%%%          
        %%%%%%%%%%%%          
       %%%%%%%%%%%%%%%        
      %%%%%%%%%%%%%%%         
     %%%%%%%%%%%%%%%%         
    %%%     %%%     %         
   #%%%  ##%%%%%##  %         
    %%%%%%%%%%%%%%%%          
    %%%%%%%%    %%%%          
    %%%%%%%%%%%%%%%%#         
    %%%%%%%%%%%%%%%##         
    ##%%%%%%%%%%%%###         
    ##  %%%  #      ##        
   #%%  %%           #

##

librsvg / SVG / use-after-free

VectorFreed

An image, and a pointer left behind.

A librsvg use-after-free, with RCE confirmed across multiple applications.

Same name, different entity.

librsvg uses libxml2 to read the XML inside an SVG image. While expanding an entity, an XInclude can start parsing another document. Both parses share librsvg’s entity map.

If the included document declares an entity with the same name, librsvg replaces the entry and frees the old one. The outer parse still holds a pointer to it. When it resumes, it uses freed memory that may now belong to another object.

01 / retainouter parsexmlEntity Apointer still held

02 / replacenested XIncludefree(A)same entity name

03 / resumeouter parseuse(A)dangling pointer

shared entity map overlapping lifetimes

That lifetime mismatch is the use-after-free. librsvg advisory ↗

The cases with public advisories.

I confirmed RCE in several applications using librsvg. Next.js and Ghost are the cases I reported that led to public advisories, covered below.

Each product carried input into the parser differently. Having librsvg among the dependencies does not, by itself, make an application exploitable.

Next.js / ImageResponse

text → Satori → SVG → Sharp / libvips → librsvg

A separate escaping bug in Satori let attacker-controlled text alter the generated SVG. In the Node.js runtime, ImageResponse passed that SVG into the native image pipeline. This path does not apply to the Edge runtime.

CVE-2026-94545 ↗

Next.js / Image Optimization

image source → /_next/image → Sharp / libvips → librsvg

When the API accepted an attacker-controlled image source, a crafted image could pass its SVG rejection and later be decoded as SVG by Sharp/libvips. This exposed the UAF to unauthenticated requests on glibc-based Linux, without involving Satori.

CVE-2026-96889 ↗

Ghost / bookmark cards

staff account → bookmark image → image processing → librsvg

A staff user, including a Contributor, could create a bookmark card for a site they controlled. Processing the card image reached the vulnerable library. This path also allowed command execution on the server.

CVE-2026-105642 ↗

The details, builds, and PoC limitations are in the research repository ↗.

The public records.

librsvg and the Image Optimization path share CVE-2026-96889. ImageResponse and Ghost have their own records.

Same name, different entity.

The cases with public advisories.

The public records.

Citations.