rsync Heap Memory Corruption via Argument List

Executive Summary

CVE-2026-70456 is a high-severity out-of-bounds write vulnerability in rsync versions 3.0.1 through 3.4.4. It occurs in the read_args() function when a crafted argument list causes the trailing NULL terminator to be written one slot beyond the allocated argv memory buffer. This corrupts adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed rsync version on your system using the command: rsync --version. If the version is between 3.0.1 and 3.4.4 inclusive, the system is vulnerable. Additionally, monitor network traffic for rsync daemon connections and inspect logs for unusual argument lists that may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to corrupt heap memory, potentially leading to crashes, arbitrary code execution, or denial of service. Since rsync is often used for file transfers, remote exploitation via a malicious sender is possible without privileges or user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade rsync to version 3.5.0 or later. If upgrading is not possible, disable the rsync daemon service or restrict access to trusted networks only. Apply network-level mitigations such as firewalls to block unauthorized rsync connections until the update is completed.

Useful 0 Not Useful 0