Heap Buffer Overflow in rsyslog via RainerScript replace()

Executive Summary

CVE-2026-78002 is a heap buffer overflow vulnerability in the rsyslog software. It occurs in the RainerScript replace() function when processing attacker-controlled syslog messages. The flaw arises from incorrect buffer size calculation during string replacement, leading to memory corruption. Exploitation can cause the rsyslog daemon to crash, resulting in a denial of service (DoS).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor rsyslog daemon crashes or unusual termination. Check logs for heap corruption errors or segmentation faults. Use commands like 'journalctl -u rsyslog' or 'grep -i error /var/log/messages' to review system logs for signs of exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to send specially crafted syslog messages that trigger a heap buffer overflow. Successful exploitation can crash the rsyslog daemon, disrupting logging services and causing a DoS on the affected system. Systems configured to receive remote syslog messages are particularly at risk.

Useful 0 Not Useful 0

Mitigation Strategies

• Update rsyslog to version 2026-08-24 daily stable build or later to patch the vulnerability.
• Avoid applying the replace() or wrap() functions to untrusted network input in rsyslog configuration.
• Restrict network access to rsyslog service by configuring firewall rules for UDP/TCP port 514 to allow only trusted hosts.
• Disable imudp and imtcp modules in rsyslog configuration if remote logging is unnecessary.
• Restart rsyslog or firewall service after applying changes.

Useful 0 Not Useful 0