CVE-2026-70459

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in rsync Daemon

Publication date: 2026-08-13

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-31

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-70459

EUVD

EUVD-2026-58045

Affected Vendors & Products

Vendor	Product	Version / Range
samba	rsync	From 3.0.0 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

CVE-2026-70459 is a null pointer dereference vulnerability in rsync versions 3.0.0 through 3.4.4. It occurs when a remote attacker sends a malformed file list to the rsync daemon where the first entry is a dot entry not explicitly typed as a directory. The daemon incorrectly dereferences an uninitialized pointer, causing a crash.

Detection Guidance

To detect this vulnerability, check if your rsync version is between 3.0.0 and 3.4.4. Run 'rsync --version' to see the installed version. If vulnerable, the daemon may crash when receiving a malformed file list with a dot entry not typed as a directory.

Impact Analysis

This vulnerability allows attackers to crash the rsync daemon by sending a specially crafted file list. This results in a denial of service (DoS) for the connection, preventing legitimate users from transferring files. The attack requires no authentication and can be executed remotely over a network.

Compliance Impact

This vulnerability primarily causes a denial of service (DoS) by crashing the rsync daemon, which could disrupt data transfer operations. It does not directly affect data confidentiality or integrity, so its impact on compliance with standards like GDPR or HIPAA is likely minimal unless the DoS disrupts critical data processing or backup systems.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, restrict access to rsync modules or disable anonymous writable modules to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-70459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70