Integer Overflow Vulnerability in Rsync from Rsync Project

CVE-2026-43618

What is CVE-2026-43618?

An integer overflow vulnerability exists in Rsync versions 3.4.2 and earlier, specifically within the compressed-token decoder. The flaw arises from a 32-bit signed counter that fails to check for overflow conditions. This oversight allows an attacker to manipulate the data sent to the receiver, potentially causing an overflow that can lead to the disclosure of sensitive process memory information. Such data may include environment variables, passwords, as well as stack and heap information, ultimately undermining Address Space Layout Randomization (ASLR) effectiveness and opening avenues for further exploitation.

References