PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← Back | CVE Intelligence Hub

CVE-2026-96889[Critical]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-96889.

Vendor
GNOME / Vercel
Product
librsvg / Next.js
Affected versions
librsvg < 2.63.2; Next.js 16.2.0-16.3.5 / 10.0.0-15.5.27, 16.0.0-16.4.0
CVSS
9.5
Coverage Span
2026-09-24
Reports
1 related reports

Associated Reports & Timeline

1.
VectorFreed: librsvg Use-After-Free (CVE-2026-96889) Leading to RCE in Next.js and Downstream Frameworks
github.com | vulnerability | Critical | | Original ↗ | .md | #rce | #supply-chain | #red-team | #exploitation
# VectorFreed ## Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I (@rafabd1) found in librsvg (CVE-2026-96889). In a Node.js/Sharp/libvips...
Why it matters: Demonstrates how an upstream native C library memory corruption bug in an image rendering stack (librsvg/libvips) propagates into widely used web frameworks, creating severe unauthenticated RCE attack vectors.