CVE-2026-78002

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in rsyslog via RainerScript replace()

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: redhat-SADP

Description

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-78002

EUVD

EUVD-2026-67085

Affected Vendors & Products

Vendor	Product	Version / Range
rsyslog	rsyslog	*
rsyslog	rsyslog	From 8.6.0 (inc) to 8.2608.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

CVE-2026-78002 is a heap buffer overflow vulnerability in the rsyslog software. It occurs in the RainerScript replace() function when processing attacker-controlled syslog messages. The flaw arises from incorrect buffer size calculation during string replacement, leading to memory corruption. Exploitation can cause the rsyslog daemon to crash, resulting in a denial of service (DoS).

Detection Guidance

To detect this vulnerability, monitor rsyslog daemon crashes or unusual termination. Check logs for heap corruption errors or segmentation faults. Use commands like 'journalctl -u rsyslog' or 'grep -i error /var/log/messages' to review system logs for signs of exploitation attempts.

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to send specially crafted syslog messages that trigger a heap buffer overflow. Successful exploitation can crash the rsyslog daemon, disrupting logging services and causing a DoS on the affected system. Systems configured to receive remote syslog messages are particularly at risk.

Compliance Impact

This vulnerability primarily causes denial of service (DoS) by crashing rsyslog, which could disrupt logging services. For GDPR, this may affect data integrity and availability requirements. For HIPAA, it could impact audit logging and system reliability. However, no evidence suggests confidentiality or integrity loss.

Mitigation Strategies

Update rsyslog to version 2026-08-24 daily stable build or later to patch the vulnerability.
Avoid applying the replace() or wrap() functions to untrusted network input in rsyslog configuration.
Restrict network access to rsyslog service by configuring firewall rules for UDP/TCP port 514 to allow only trusted hosts.
Disable imudp and imtcp modules in rsyslog configuration if remote logging is unnecessary.
Restart rsyslog or firewall service after applying changes.

Hi! I’m here to help you understand CVE-2026-78002. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70