CVE-2026-70456
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
rsync versions 3.0.1 before 3.5.0 contain an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.
Risk Assessment
The vulnerability can lead to memory corruption, potentially enabling remote code execution or causing service crashes.
Recommendation
Update rsync to version 3.5.0 or later, which contains the fix.
Original NVD description (English source)
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.