CVE-2026-70458: rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
Published Aug 13, 2026
·Updated
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINKBUMP processing on file entries with the FLAGHLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing FSUM field in the filestruct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
Affected Software
1 affected component
Rsync>3.0.0<3.5.0
Event History
Aug 13, 2026
CVE Published
via MITRE·02:44 PM
Data Sourced
via MITRE·02:44 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-70458?
CVE-2026-70458 has a severity rating of high, with a score of 8.2.
2
How do I fix CVE-2026-70458?
To fix CVE-2026-70458, upgrade rsync to version 3.5.0 or later.
3
What type of vulnerability is CVE-2026-70458?
CVE-2026-70458 is an out-of-bounds write vulnerability.
4
What software is affected by CVE-2026-70458?
The vulnerability affects rsync versions prior to 3.5.0.
5
Can CVE-2026-70458 be exploited remotely?
Yes, CVE-2026-70458 can be exploited remotely due to its nature of memory corruption.