CVE-2026-70461: rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
Other sources
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the addimpliedinclude() function to under-count the trailing backslash when sizing the destination buffer.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70461?
CVE-2026-70461 has a high severity rating of 8.2.
How do I fix CVE-2026-70461?
To fix CVE-2026-70461, upgrade rsync to version 3.5.0 or later.
What type of attack does CVE-2026-70461 facilitate?
CVE-2026-70461 allows remote unauthenticated attackers to perform a heap out-of-bounds write.
What versions of rsync are affected by CVE-2026-70461?
CVE-2026-70461 affects rsync versions prior to 3.5.0.
Can CVE-2026-70461 be exploited without authentication?
Yes, CVE-2026-70461 can be exploited by unauthenticated attackers.