CVE-2026-70458: rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAGHLINKED Handling
Other sources
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the filestruct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1 - Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1Fixed in 3.5.1+ds1-2Fixed in 3.5.2+ds1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70458?
CVE-2026-70458 has a severity rating of high, with a score of 8.2.
How do I fix CVE-2026-70458?
To fix CVE-2026-70458, upgrade rsync to version 3.5.0 or later.
What type of vulnerability is CVE-2026-70458?
CVE-2026-70458 is an out-of-bounds write vulnerability.
What software is affected by CVE-2026-70458?
The vulnerability affects rsync versions prior to 3.5.0.
Can CVE-2026-70458 be exploited remotely?
Yes, CVE-2026-70458 can be exploited remotely due to its nature of memory corruption.