CVE-2026-70457: rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parsesizearg()
Other sources
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70457?
The severity of CVE-2026-70457 is classified as medium with a score of 6.5.
What type of vulnerability is CVE-2026-70457?
CVE-2026-70457 is an out-of-bounds write vulnerability found in the rsync application.
How do I fix CVE-2026-70457?
To fix CVE-2026-70457, you should upgrade rsync to version 3.5.0 or later.
What versions of rsync are affected by CVE-2026-70457?
Rsync versions before 3.5.0 are affected by CVE-2026-70457.
What does CVE-2026-70457 affect in rsync?
CVE-2026-70457 affects the parse_size_arg() function, specifically how it handles the return value of snprintf() without bounds checking.