https://seclists.org/oss-sec/2026/q3/609: CVE-2026-78002: rsyslog RainerScript place() heap buffer overflow
Published Aug 29, 2026
·Updated
Affected Software
2 affected components
rsyslog Rsyslog>=8.6.0<=8.2608.0
rsyslog Rsyslog>=undefined
Frequently Asked Questions
1
Are standard rsyslog deployments affected without configuration changes?
No. The issue is not active in the default configuration; exposure requires a ruleset that uses replace() or the three-argument form of wrap() on sender-controlled or otherwise untrusted data.
2
What conditions must be present for an attacker to trigger the overflow?
The affected ruleset must process untrusted source data using replace() or three-argument wrap(), with a search string of at least two characters and a replacement string longer than the search string. The input must also contain the relevant partial-match pattern.
3
How can I determine whether my deployment is exposed?
Review active rsyslog rulesets for calls to replace() and three-argument wrap(). For each use, determine whether the source argument can contain sender-controlled or otherwise untrusted data and whether the search and replacement strings meet the stated length conditions.