CVE-2026-70461
Received Received - Intake

Heap Out-of-Bounds Write in Rsync

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-70461
EUVD
EUVD-2026-58043

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70461 is a heap out-of-bounds write vulnerability in rsync versions 3.2.5 through 3.4.4. It allows unauthenticated remote attackers to write one byte past a heap allocation's boundary by crafting a malicious files-from entry containing both an interior and trailing backslash. This causes the add_implied_include() function to miscalculate the destination buffer size, leading to memory corruption.

Detection Guidance

To detect this vulnerability, check the installed rsync version on your system. Run: rsync --version. If the version is between 3.2.5 and 3.4.4 inclusive, the system is vulnerable. Additionally, monitor network traffic for rsync daemon connections with crafted --files-from arguments containing backslashes.

Impact Analysis

This vulnerability can lead to memory corruption, potentially causing crashes or enabling further exploitation. Attackers could leverage it to gain unauthorized access or execute arbitrary code on systems running vulnerable rsync versions. The impact is significant due to the remote, unauthenticated nature of the attack.

Mitigation Strategies

Immediately upgrade rsync to version 3.5.0 or later. If upgrading is not possible, disable the rsync daemon or restrict access to trusted clients. Disable the --files-from option if not required. Apply network-level mitigations like firewalls to block unauthorized rsync connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70461. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart